External risk intelligence

Tenda Camera Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-23080

The affected products are Tenda security cameras (IP cameras). These devices are commonly deployed in configurations that allow for remote access via the internet to facilitate mobile viewing and management, making the management interface or associated services a commonly exposed network-facing surface.

Command Injection

Tenda It7 Lcs Firmware

2209020914 and earlier2209020908 and earlier20220906024_2025 and earlier1.10.00.2211041403 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in certain Tenda security camera products that could allow unauthorized individuals to execute commands on the devices. While the main concern is confirming relevance and exposure, this type of issue can potentially disrupt operations or lead to unauthorized access if exploited.

Unauthorized command execution in Tenda cameras.
Critical flaw could allow remote device compromise.
Confirm relevance and understand potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network requests to an exposed Tenda device. Because the vulnerability allows for command injection, successful exploitation could enable an attacker to execute arbitrary commands on the affected device, potentially leading to a complete system compromise.

Network access required.
Unauthenticated commands trigger vulnerability.
Full device control.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject and execute arbitrary commands on affected Tenda devices when these devices are exposed to the network. This could potentially impact the device's intended functionality and lead to unauthorized access or control.

Device system commands could be compromised.
Network-accessible interfaces could be exploited.
Device functionality could be disrupted.

Operational Fix

Recommended remediation, mitigation, and detection steps

The primary responsibility for addressing this vulnerability likely falls to the infrastructure or network security teams responsible for managing Tenda devices. The first practical step is to inventory all deployed Tenda CP7, CP3, IT7-PCS, IT7-LCS, and IT7-PRS devices, determine their network exposure, and identify business-critical assets among them. This will inform the prioritization and planning for remediation, which may involve vendor coordination or applying available patches.

Infrastructure and security teams own remediation.
Verify device exposure and business criticality first.
Plan remediation based on risk and vendor advisories.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What are Tenda CP3, CP7, and IT7 series devices?

These devices are internet-protocol (IP) security cameras designed for monitoring homes or small business environments. They typically include integrated firmware to manage video streaming, motion detection, and remote viewing capabilities. Users connect these cameras to their local network to access live feeds via mobile apps or web interfaces, often bridging the gap between physical site security and digital network management.

What is command injection in the context of CVE-2023-23080?

This vulnerability is classified as CWE-77, which refers to improper neutralization of special elements used in an OS command. In simpler terms, the camera's software fails to properly filter user input before processing it. An attacker can exploit this by inputting malicious system commands that the device mistakenly executes, effectively allowing them to run unauthorized actions with the same permissions as the device's internal operating system.

How does an attacker trigger this command injection?

The flaw is triggered when an attacker sends a specially crafted network request to the device. Because the device does not properly validate incoming traffic, the injected code is executed automatically. Note that this requires network connectivity to the camera; the bug is not triggered by physical interaction with the device buttons or by simple, legitimate administrative configuration changes.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal identifies these cameras as having a 'Likely' risk score because they are often deployed with remote access enabled for mobile viewing. If your device is accessible via the internet, it presents a much larger surface for potential attackers compared to a device restricted to a private, internal-only network. Understanding whether your specific camera is reachable from the public internet is key to determining your exposure.

What should I do if I use these Tenda cameras?

Start by auditing your network to list all deployed Tenda CP3, CP7, IT7-PCS, IT7-LCS, and IT7-PRS units. Determine which cameras are reachable from the internet versus those on isolated internal segments. Once you have identified the most critical or exposed devices, coordinate with your IT team to check for manufacturer-provided firmware updates that address this command injection flaw.

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.