Description
A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carried out remotely.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Tenda | CH7 | 20260625 | — |
| Tenda | CH7G | 20260625 | — |
| Tenda | CH10 | 20260625 | — |
| Tenda | CP3 | 20260625 | — |
| Tenda | CP3 Pro | 20260625 | — |
| Tenda | CP7 | 20260625 | — |
| Tenda | TC3B14C | 20260625 | — |
| Tenda | TC3B15C | 20260625 | — |
| Tenda | TC3T14C | 20260625 | — |
| Tenda | TC3T15C | 20260625 | — |
References
- VDB-389498 | Tenda CH7 ATE Module Kylin HandleCmd command injection vdb-entry technical-description
- VDB-389498 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-19747 | CVE Analysis and Report third-party-advisory
- Submit #868463 | Tenda Tenda Multiple IP Cameras Multiple Versions Command Injection third-party-advisory
- https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20Command%20Injection/Tenda%20Command%20Injection.md related
- https://www.tenda.com.cn/ product