External risk intelligence

Tenda CP3 Network Configuration Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-86151

The affected product is a Tenda CP3, which is a consumer-grade network camera. These devices are designed to be managed via a web interface and are commonly exposed to the internet to provide remote monitoring capabilities to users, placing the network configuration management surface in a position where it is frequently reachable from the public internet.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Tenda network configuration management components that could allow remote attackers to inject operating system commands. This issue stems from a flaw in a specific function within the system's API. The main concern at this time is confirming if our environment has this specific technology and assessing any potential exposure.

Attackers can run commands remotely.
It involves network device configuration management.
Confirm relevance and exposure to our systems.

Attack Path

How an attacker could exploit the issue

An attacker could remotely initiate an attack against the network configuration management feature on Tenda CP3 devices. By manipulating a specific function within the `Apis/system.c` file, an attacker could inject operating system commands. This vulnerability, if exploited, could lead to significant compromise.

Requires authenticated access.
Achieved by manipulating the system configuration function.
Allows for remote command execution.

Live Threat

Current exploitation, exposure, and threat context

A vulnerability in the network configuration management component could allow an authenticated attacker with remote access to inject operating system commands. This could impact the device's configuration and network behavior when supported by the advisory's conditions.

System configuration and network access.
Remote command injection via network management.
Compromised device settings and network control.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this critical operating system command injection vulnerability, the team responsible for managing network devices and their configurations, likely the Infrastructure or Network Operations team, should take the lead. The immediate first step is to identify all instances of the affected Tenda CP3 devices within the environment, determine their reachability, assess their business criticality, and confirm the accountable owner before planning any remediation.

Identify accountable infrastructure or network team.
Verify device exposure and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Tenda CP3?

The Tenda CP3 is a consumer-grade network camera used for remote video monitoring. It includes embedded software for managing network settings and device configurations through a web interface, which is the specific component affected by this vulnerability.

What does CVE-2026-86151 mean by OS command injection?

This vulnerability, classified as CWE-77 or CWE-78, occurs when a program improperly processes input, allowing an attacker to insert and execute their own system-level commands. In this case, manipulating a specific function in the device's system configuration API lets an unauthorized command bypass intended constraints.

How is this vulnerability triggered?

An attacker initiates the vulnerability by sending malicious input to the network configuration management function. It is important to note that this requires administrative credentials; the vulnerability is not triggered by simple, unauthenticated network traffic alone.

Is my Tenda CP3 device at risk?

Halo Surface Signal indicates that Tenda CP3 cameras are frequently exposed to the internet to enable remote monitoring. If your device is accessible from the public internet, it falls into a high-risk category because the network management surface is reachable by remote attackers.

What should I do if I use Tenda CP3 devices?

Begin by creating an inventory of all Tenda CP3 units in your environment to verify their presence. Assess whether these devices are internet-facing, determine who is responsible for their maintenance, and prioritize isolating any units that do not strictly require remote access while waiting for vendor guidance.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.