Executive brief
Tenda CP3 is a network management device used for monitoring and control of network infrastructure. A remote attacker can inject arbitrary OS commands through the interface_name/host parameter in the network ping functionality, allowing complete system compromise without requiring authentication.
Technical details
This vulnerability is a classic OS command injection flaw in the NetCheckPing.cpp component of Tenda CP3. The vulnerable code fails to properly sanitize the interface_name or host parameter before passing it to system commands, allowing an attacker to concatenate shell metacharacters and arbitrary commands. The attack is network-accessible and requires no prior authentication or user interaction. Successful exploitation allows remote code execution with the privileges of the affected service, typically enabling full system takeover. A patch or upgrade is recommended; check Tenda's official security advisories for available updates.
Affected products
- Tenda CP3 27.5.57.101
Timeline
- 2026-09-05: disclosed