External risk intelligence

Tenda CP3 OS Command Injection

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-86152

The affected product is a consumer network device (Tenda CP3). Such devices are commonly connected directly to the internet or exposed via edge gateways to facilitate remote management and connectivity features, making their management or service interfaces frequently accessible from the public internet.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Tenda CP3 devices that could allow remote attackers to inject operating system commands. This issue stems from a flaw in how the device handles certain functions, potentially leading to unauthorized system control. The primary concern is confirming if this specific technology is in use and assessing any exposure.

A remote flaw allows unauthorized command execution.
Leadership should remember it due to remote attack possibility.
Confirm relevance and exposure of this device type.

Attack Path

How an attacker could exploit the issue

An attacker can remotely trigger a vulnerability in the Tenda CP3 device by manipulating a specific function related to Wi-Fi settings. This manipulation can lead to the execution of arbitrary commands on the device's operating system.

No special access needed.
Triggered via function manipulation.
Allows remote command execution.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could execute arbitrary operating system commands on the affected device by exploiting a flaw in the `CAutoAddWifi::ThreadProc` function. This could lead to a compromise of the device's underlying operating system when supported by the advisory.

System data and device control at risk.
Remote unauthenticated command injection possible.
Complete device compromise could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that the vulnerable component is a consumer network device, product owners or the teams managing edge devices are likely responsible for addressing this command injection flaw. The immediate priority should be to identify all instances of the affected device, assess their exposure to the internet, and determine their business criticality. Once this inventory is complete, the accountable owner can be identified to plan for remediation, which may involve coordination with the vendor or implementing compensating controls if direct patching is not immediately feasible.

Product or infrastructure owners must lead.
Verify external reachability and criticality.
Plan vendor coordination or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Tenda CP3?

The Tenda CP3 is a consumer-grade security camera designed for home monitoring. It provides features like remote connectivity and network management. These devices often include integrated components, such as the Kylin module, which handle automated tasks like Wi-Fi configuration and device communication.

What does OS command injection mean for CVE-2026-86152?

This vulnerability, classified as CWE-77 and CWE-78, means an attacker can force the device to run unauthorized instructions on its underlying operating system. Instead of performing its intended task, the affected software processes malicious input as a command, potentially granting the attacker total control over the device's functions and data.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by interacting with the CAutoAddWifi::ThreadProc function, which manages Wi-Fi settings. The bug is triggered through malicious input sent to this specific process. Simply having the device powered on or connected to a local network does not trigger the bug; the attacker must actively reach and manipulate this vulnerable code path.

Is my Tenda CP3 at risk?

According to Halo Surface Signal, the Tenda CP3 is a consumer network device often connected directly to the internet for remote access features. Because the attack can be launched remotely without authentication, any instance reachable from the public internet is at higher risk. Devices kept strictly on isolated internal networks are less accessible to external threats.

What should I do to secure my device?

Prioritize identifying all Tenda CP3 units within your environment. Check if they are exposed to the public internet and evaluate their necessity. If they must be online, restrict access to trusted networks or use firewalls to block unauthorized traffic. Coordinate with the manufacturer for official updates or guidance on disabling the vulnerable component if patching is not currently available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.