CVE-2026-86148 — Tenda CP3 Kylin system.c SystemAsh os command injection
A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulatio…
Published: 2026-09-05 · CVSS: 9.4 · CVSS 4.0
A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7