External risk intelligence

Tenda CP3 SystemAsh OS Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-86148

The affected product is a Tenda CP3, which is a consumer-grade network camera. These devices are commonly deployed as internet-facing appliances with remote access functionality, making their management interfaces or web-based services reachable from the public internet in typical real-world deployments.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security vulnerability has been identified in a Tenda product, specifically affecting a function within its Kylin component. This flaw allows for remote exploitation through manipulation of a URL argument, potentially leading to command injection. The main concern is confirming the relevance and exposure of this vulnerability to our deployed environment.

Flaw allows remote attackers to inject commands.
Important if Tenda network cameras are in use.
Verify if this product is part of our infrastructure.

Attack Path

How an attacker could exploit the issue

An attacker can remotely exploit this vulnerability by targeting a specific function within the device's system API. This function is susceptible to specially crafted input that can be manipulated to inject operating system commands. Successful exploitation could allow an attacker to take significant control of the affected device.

Requires authenticated access.
Vulnerable function processes a specific argument.
Risk of full system compromise.

Live Threat

Current exploitation, exposure, and threat context

A security flaw in the Tenda CP3 camera's system function could allow an attacker with administrative privileges to inject operating system commands by manipulating the `AlarmVoiceURL` argument. This could affect the camera's service behavior and potentially lead to unauthorized system-level actions when the attack is launched remotely.

System commands could be executed.
Attacker manipulates a URL argument.
Unauthorized system actions may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The real-world ownership of this critical vulnerability likely resides with teams managing network-attached devices, such as infrastructure or security operations. The first practical step involves identifying all instances of the affected technology, confirming their external reachability or business criticality, and then locating the accountable owner for coordinated remediation planning.

Own by infrastructure and security teams.
Verify external exposure and criticality first.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Tenda CP3 and what is it used for?

The Tenda CP3 is a consumer-grade network camera designed for home or small office monitoring. It functions as a connected appliance, using a component called Kylin to manage system tasks and communications over a network. People typically use these devices to capture video feeds and manage security settings through web-based interfaces.

What does OS command injection mean for CVE-2026-86148?

This vulnerability, classified as CWE-77 or CWE-78, occurs when software improperly processes input, allowing a user to insert their own commands into the system. In the context of this CVE, an attacker manipulates the AlarmVoiceURL argument, tricking the device into executing unauthorized operating system instructions. This effectively grants the attacker the ability to perform actions at the system level.

How is this vulnerability triggered in the Tenda CP3?

An attacker triggers this flaw by sending a specially crafted input to the SystemAsh function within the Kylin component. This specifically involves manipulating the AlarmVoiceURL argument. It is important to note that the vulnerability requires administrative privileges to execute the malicious commands; it cannot be triggered by an unauthorized or unauthenticated user attempting to access the system remotely.

Is my Tenda camera at risk if it is not facing the internet?

Halo Surface Signal indicates that Tenda CP3 cameras are often deployed with remote access features that make them reachable from the public internet. While an internet-facing device is more easily targeted, any instance of this device on your network could be vulnerable if an attacker gains the necessary administrative access. You should evaluate its reachability regardless of its current network placement.

How should I respond to this security notice?

Begin by identifying every Tenda CP3 camera currently in use within your environment. Verify where each device is placed to determine if it is accessible from the internet or restricted to an internal network. Once you have an inventory, coordinate with your infrastructure or security team to track official updates from the manufacturer and plan for remediation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.