Tenda Cp3 Pro vulnerabilities
5 vulnerabilities
Known vulnerabilities in Tenda Cp3 Pro, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2025-52363tenda · cp3_pro_firmwaretenda cp3_pro_firmwareTenda CP3 Pro Firmware V22.5.4.93 contains a hardcoded root password hash in the /etc/passwd file and /etc/passwd-. An attacker with access to the firmware image can extract and attempt to crack the root password hash, potentially obtaining administrative accessEPSS0.24%HighCVE-2025-52364tenda · cp3_pro_firmwaretenda cp3_pro_firmwareInsecure Permissions vulnerability in Tenda CP3 Pro Firmware V22.5.4.93 allows the telnet service (telnetd) by default at boot via the initialization script /etc/init.d/eth.sh. This allows remote attackers to connect to the device s shell over the network, potentially without authentication if default or weak credentials are presentEPSS0.56%CriticalCVE-2026-19747tenda · ch10 +9 moreTenda CH7 ATE Module Kylin HandleCmd command injectionA weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carried out remotely.EPSS3.06%MediumCVE-2026-19748tenda · ch10 +9 moreTenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropyA security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManager_ParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument SESSION leads to insufficient entropy. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is told to be difficult.EPSS0.49%MediumCVE-2026-19749tenda · ch10 +9 moreTenda CH7 RTSP/ONVIF missing authenticationA vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability is an unknown functionality of the component RTSP/ONVIF. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is now public and may be used.EPSS0.63%