Tenda Cp3 vulnerabilities

16 vulnerabilities

Known vulnerabilities in Tenda Cp3, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

8.8HighCVE-2025-5763tenda · cp3_firmwareTenda CP3 apollo sub_F3C8C command injectionA vulnerability has been found in Tenda CP3 11.10.00.2311090948 and classified as critical. Affected by this vulnerability is the function sub_F3C8C of the file apollo. The manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.EPSS4.79%10CriticalCVE-2026-86152tenda · cp3_firmwareTenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injectionA flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attack may be launched remotely.EPSS2.88%9.4CriticalCVE-2026-86148tenda · cp3_firmwareTenda CP3 Kylin system.c SystemAsh os command injectionA security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely.EPSS2.94%9.4CriticalCVE-2026-86151tenda · cp3_firmwareTenda CP3 Network Configuration Management system.c sub_2F77E8 os command injectionA vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection. The attack may be initiated remotely.EPSS2.94%5.1MediumCVE-2026-86150tenda · cp3_firmwareTenda CP3 hostapd hard-coded credentialsA security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpa_passphrase leads to hard-coded credentials. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.EPSS0.38%9.4CriticalCVE-2026-86149tenda · cp3_firmwareTenda CP3 NetCheckPing.cpp os command injectionA weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the argument interface_name/host causes os command injection. The attack can be initiated remotely.EPSS2.94%9.4CriticalCVE-2026-86153tenda · cp3_firmwareTenda CP3 Redirect.cpp SetRedirectEnable privileges managementA vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the attack is possible.EPSS0.71%10CriticalCVE-2026-19747tenda · ch10 +9 moreTenda CH7 ATE Module Kylin HandleCmd command injectionA weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carried out remotely.EPSS3.06%6.3MediumCVE-2026-19748tenda · ch10 +9 moreTenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropyA security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManager_ParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument SESSION leads to insufficient entropy. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is told to be difficult.EPSS0.49%6.3MediumCVE-2026-19749tenda · ch10 +9 moreTenda CH7 RTSP/ONVIF missing authenticationA vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability is an unknown functionality of the component RTSP/ONVIF. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is now public and may be used.EPSS0.63%7.5HighCVE-2023-30351tenda · cp3_firmwaretenda cp3_firmwareShenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for root which is stored using weak encryption. This vulnerability allows attackers to connect to the TELNET service (or UART) by using the exposed credentials.EPSS0.24%9.8CriticalCVE-2023-30354tenda · cp3_firmwaretenda cp3_firmwareShenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 does not defend against physical access to U-Boot via the UART: the Wi-Fi password is shown, and the hardcoded boot password can be inserted for console access.EPSS0.45%9.8CriticalCVE-2023-30352tenda · cp3_firmwaretenda cp3_firmwareShenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for the RTSP feed.EPSS0.66%7.5HighCVE-2023-30356tenda · cp3_firmwaretenda cp3_firmwareMissing Support for an Integrity Check in Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows attackers to update the device with crafted firmwareEPSS0.27%9.8CriticalCVE-2023-30353tenda · cp3_firmwaretenda cp3_firmwareShenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows unauthenticated remote code execution via an XML document.EPSS1.21%9.8CriticalCVE-2023-23080tenda · cp3_firmware +4 moretenda cp3_firmwareCertain Tenda products are vulnerable to command injection. This affects Tenda CP7 Tenda CP7<=V11.10.00.2211041403 and Tenda CP3 v.10 Tenda CP3 v.10<=V20220906024_2025 and Tenda IT7-PCS Tenda IT7-PCS<=V2209020914 and Tenda IT7-LCS Tenda IT7-LCS<=V2209020914 and Tenda IT7-PRS Tenda IT7-PRS<=V2209020908.EPSS2.46%