CVE-2026-86149

Executive Summary

CVE-2026-86149 is a critical OS command injection vulnerability affecting the Tenda CP3 network camera firmware version 27.5.57.101. The flaw resides in the Net/NetCheckPing.cpp file, where manipulation of the interface_name or host argument allows a remote attacker to execute arbitrary operating system commands with elevated privileges. With a CVSS score of 9.1, the vulnerability requires high-privilege authentication but can compromise the entire device and potentially pivot into the broader network. No patch is currently available, and no public exploit code has been released. Affected organizations should treat all Tenda CP3 devices running version 27.5.57.101 as compromised or potentially compromised.

Technical Analysis

The vulnerability is classified as CWE-77 (Command Injection), indicating that the application constructs a shell command using user-supplied input without adequate sanitization or escaping. Specifically, the issue exists in the file Net/NetCheckPing.cpp, which corresponds to the network diagnostic ping-checking functionality common in embedded device web management interfaces.

The vulnerable parameters are interface_name and host. The host parameter is particularly concerning because ping utilities inherently accept an IP address or hostname; however, if the application passes this value directly into a system shell call (e.g., system("ping " + host)), an attacker can inject command separators such as ;, &&, ||, or backticks to append arbitrary operating system commands.

The NVD description indicates the impact scope is "Changed" (S:C), meaning a compromise of the device can affect resources beyond the device itself, such as the underlying host operating system or adjacent network segments. The interface_name parameter suggests the ping tool also accepts a network interface specification, which further expands the injection surface.

Attack surface characteristics:

• Remote exploitability: The attack can be initiated remotely (AV:N), meaning the vulnerable management interface is network-accessible.
• High privilege requirement: PR:H indicates an attacker must first authenticate with high-privileged credentials (e.g., administrator). This could be obtained via default credentials, credential stuffing, or by chaining with another vulnerability.
• No user interaction: UI:N means the attack is fully automated once access is established.
• High impact on confidentiality, integrity, and availability across all three CIA dimensions (C:H/I:H/A:H).

The vulnerability vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H places this in the critical range (9.1). From a technical standpoint, the attack requires a valid web session with administrative access to the device, followed by a crafted HTTP request to the ping-checking endpoint.

Insufficient technical detail is available regarding the exact HTTP request structure, parameter encoding, or whether input validation exists for some characters. No patch evidence exists from any tracked source (patch confidence 0/4). The device is confirmed as UNPATCHED.

Exploitation Scenarios

Prerequisite: Attacker possesses valid high-privilege credentials for the Tenda CP3 web management interface (or a chained authentication-bypass vulnerability is used). Given the prevalence of default credentials and credential reuse campaigns targeting IoT devices, the privilege requirement is not a substantial barrier.

Reconnaissance/Target Identification:

1. Attacker performs a Shodan, Censys, or Fofa search for internet-exposed Tenda CP3 cameras (commonly on ports 80/443 for web UI, possibly 8080).
2. FINGERPRINT: The login page and HTTP response banners help identify the device model and firmware version 27.5.57.101.

Flaw Trigger: 3. Authentication: The attacker logs in to the admin interface using acquired or default credentials. 4. The attacker navigates to the network diagnostic / ping-check feature in the management UI. The host parameter accepts a hostname or IP address for ICMP testing.

Payload Execution (vulnerability-class level): 5. The attacker submits a request where the host argument is manipulated to include command injection syntax. Instead of a legitimate hostname, the value could be crafted as 127.0.0.1; <MALICIOUS_COMMAND> or 127.0.0.1 && <MALICIOUS_COMMAND> (exact separators cannot be confirmed without PoC). 6. The vulnerable application constructs the underlying shell command (e.g., ping <host>) and passes it to an OS shell without sanitization, causing the malicious command to be executed on the device's underlying Linux OS. 7. The same technique applies to interface_name, which may accept interface specifiers that can also be manipulated.

Post-Exploitation Impact: 8. No public PoC is available; the attack chain is inferred from the vulnerability class. However, based on the CVSS scope change (S:C) and high CIA impacts, typical outcomes include:

• Remote code execution as root or a high-privilege system user on the camera hardware.
• File system read/write (e.g., extracting or overwriting credentials, configuration).
• Establishing a persistent reverse shell or implant.
• Adding the device to a botnet (common for IoT cameras).
• Lateral movement: Since modern IoT devices often reside on a trusted internal VLAN, the compromised camera could be the initial foothold for accessing other internal systems.
• Disabling surveillance capabilities (availability loss for physical security monitoring).

Caveat: No public PoC is available. Attack chain is inferred from the vulnerability class.

Impact Assessment

Business Impact: The Tenda CP3 is an IP security camera. A remote command execution vulnerability poses risks to both physical security (camera can be disabled or feed can be tampered with) and cybersecurity (the device can be leveraged as an attack platform). With no patch available and no public exploit yet, this may be a zero-day under active exploitation by sophisticated actors or will become publicly exploitable once researchers publish analysis of this NVD entry.

Affected Systems: All Tenda CP3 devices running firmware version 27.5.57.101. Previous firmware versions are not explicitly listed as affected, but it is highly likely that earlier versions share the same code path; however, only 27.5.57.101 is confirmed vulnerable per the NVD description.

Blast Radius & CVSS Subscore Analysis:

• Attack Vector: Network — any internet-facing device is at risk.
• Scope: Changed — The impact extends beyond the camera to the host OS and the network segment it resides on. If the camera is on a shared VLAN with workstations or servers, an attacker gains a channel to pivot.
• Confidentiality/Integrity/Availability: High/High/High — Full device OS compromise, data exfiltration, config tampering, camera disruption.
• No User Interaction & Low Attack Complexity — The attack is reliable and can be automated at scale once a payload pattern is known.

EPSS: Not yet scored by FIRST.org — exploitation probability is currently unquantified. Do not assume low risk solely because EPSS is absent.

CISA KEV: NOT listed — no evidence of exploitation in the wild as a known exploited vulnerability as of the CVE publication. However, absence from KEV does not confirm absence of active exploitation.

Detection Guidance

The detection rules below target the HTTP request patterns and logs associated with attempted exploitation of the ping command on embedded devices. These are generic signatures aligned with the vulnerability class and may require tuning per-environment.

Sigma Rule

title: Tenda CP3 NetCheckPing Command Injection Attempt
id: 3a7f9d0e-5b2e-4b1f-9c3a-2f8e7d6c5b4a
status: experimental
description: Detects command injection attempts against the NetCheckPing.cpp endpoint in Tenda CP3 firmware 27.5.57.101
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-86149
author: ValtersIT Threat Intelligence
date: 2026/01/01
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-uri-query:
            - '*NetCheckPing*'
        c-uri|contains:
            - 'host=*;*'
            - 'host=*%3B*'
            - 'host=*|*'
            - 'host=*%7C*'
            - 'host=*&&*'
            - 'host=*%26%26*'
            - 'host=*`*'
            - 'host=*%60*'
            - 'interface_name=*;*'
            - 'interface_name=*%3B*'
    filter_normal:
        c-uri|contains:
            - 'host=127.0.0.1'
            - 'host=localhost'
    condition: selection and not filter_normal
level: critical
falsepositives:
    - Legitimate network diagnostic requests containing exotic characters in hostnames

YARA Rule

rule Tenda_CP3_Command_Injection_CVE_2026_86149
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects HTTP request payloads targeting Tenda CP3 NetCheckPing command injection"
        cve = "CVE-2026-86149"
        date = "2026-01-01"
        confidence = 70

    strings:
        $endpoint = "NetCheckPing" ascii wide nocase
        $host_param = "host=" ascii wide nocase
        $iface_param = "interface_name=" ascii wide nocase
        $semicolon = ";" ascii wide
        $url_encoded_semicolon = "%3B" ascii wide nocase
        $pipe = "|" ascii wide
        $url_encoded_pipe = "%7C" ascii wide nocase
        $andand = "&&" ascii wide
        $url_encoded_andand = "%26%26" ascii wide nocase
        $backtick = "`" ascii wide
        $url_encoded_backtick = "%60" ascii wide nocase
        $newline = "\n" ascii
        $crlf = "\r\n" ascii

    condition:
        uint16(0) == 0x4854 and // "HT"
        any of ($endpoint) and any of ($host_param, $iface_param) and
        1 of ($semicolon, $url_encoded_semicolon, $pipe, $url_encoded_pipe,
              $andand, $url_encoded_andand, $backtick, $url_encoded_backtick,
              $newline, $crlf)
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-86149 Tenda CP3 NetCheckPing OS Command Injection Attempt";
    flow:established,to_server;
    content:"NetCheckPing"; http_uri; nocase;
    pcre:"/(?:host|interface_name)=[^&\s]*(?:;|\||&&|`|%3B|%7C|%26%26|%60)/Ui";
    classtype:attempted-admin;
    reference:cve,2026-86149;
    sid:2026861
    rev:1;
)

Alternatively, a broader URI-based rule without PCRE:

alert http any any -> any any (
    msg:"CVE-2026-86149 Tenda CP3 Command Injection - Shell Metacharacters in NetCheckPing";
    flow:established,to_server;
    http.uri;
    content:"NetCheckPing"; nocase; http_uri;
    content:"host="; nocase; http_uri;
    pcre:"/host=[^\s&]*[\x3b\x7c\x26\x60]/Ui";
    sid:2026862;
    rev:1;
    reference:cve,2026-86149;
)

Note: Also consider alerting on interface_name= parameters with the same PCRE patterns.

Elastic Detection

sequence by source.ip, user.name with maxspan=5m
  [network where dns.question.name != null]     // optional initial DNS lookup
  [http where
     event.category == "web" and
     url.path contains "NetCheckPing" and
     (
       // command separators in host param
       url.query contains "host=" and
       (
         url.query contains "host=*;*" or
         url.query contains "host=*%3B*" or
         url.query contains "host=*|*" or
         url.query contains "host=*%7C*" or
         url.query contains "host=*&&*" or
         url.query contains "host=*%26%26*" or
         url.query contains "host=*`*" or
         url.query contains "host=*%60*"
       ) or
       // same for interface_name
       url.query contains "interface_name=" and
       (
         url.query contains "interface_name=*;*" or
         url.query contains "interface_name=*%3B*" or
         url.query contains "interface_name=*|*" or
         url.query contains "interface_name=*%7C*"
       )
     )
  ]

Splunk SPL Query

index=proxy OR index=web 
  uri_path="*NetCheckPing*"
  (
    (uri_query="*host=*;*" OR uri_query="*host=*%3B*") OR
    (uri_query="*host=*|*" OR uri_query="*host=*%7C*") OR
    (uri_query="*host=*&&*" OR uri_query="*host=*%26%26*") OR
    (uri_query="*host=*`*" OR uri_query="*host=*%60*") OR
    (uri_query="*interface_name=*;*" OR uri_query="*interface_name=*%3B*") OR
    (uri_query="*interface_name=*|*" OR uri_query="*interface_name=*%7C*")
  )
  NOT (uri_query="*host=127.0.0.1*" OR uri_query="*host=localhost*")
| stats count by src_ip, dest_ip, dest_port, uri_query, _time
| sort - _time

Alternate approach targeting system logs after successful exploitation (e.g., detecting spawned processes):

index=linux_os
  (process_name IN ("sh", "bash", "csh", "dash") 
    OR process_command_line="*ping*")
  AND process_parent_command_line="*NetCheckPing*"
| table _time, host, user, process_command_line, process_parent_command_line

Wazuh OSSEC Rule

<!-- Wazuh rule for CVE-2026-86149 Tenda CP3 Command Injection -->

<!-- Web log detection for suspicious access to NetCheckPing -->
<group name="tenda_cp3_injection,">
  <rule id="100861" level="12">
    <if_sid>31100</if_sid>
    <regex>(?i)NetCheckPing.*(host|interface_name)=.*(;|\||&&|`|\$\(|%3B|%7C|%26%26|%60)</regex>
    <description>Tenda CP3 (CVE-2026-86149) - OS command injection attempt detected in web request</description>
    <group>attack_command_injection,</group>
    <mitre>
      <id>T1203</id>
      <id>T1059</id>
    </mitre>
  </rule>

  <!-- System log detection: ping check with unusual shell invocation -->
  <rule id="100862" level="14">
    <if_sid>5160</if_sid>   <!-- generic process execution logs -->
    <regex>(?i)(/bin/sh|/bin/bash).*interface_name|ping.*(&&|;|\||`)</regex>
    <description>Tenda CP3 (CVE-2026-86149) - Command injection payload executed - possible RCE</description>
    <group>attack_execution,</group>
    <same_source_ip/>
  </rule>
</group>

Note: Wazuh rules rely on log source availability (web server access logs or host OS audit logs). Adjust the ruleset placement according to your deployment's log collection profile.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — No patch evidence from any tracked source. Vendor (Tenda) has not issued a security advisory or firmware update for this vulnerability.

1. Immediate Mitigations (no vendor fix available)

• Network segmentation: Move all Tenda CP3 cameras to a segregated management VLAN. Restrict inbound and outbound traffic to only required destinations (e.g., NVR, VMS server).
• Access control: Restrict access to the camera web management interface by IP allowlist. Do not expose the management interface to the internet.
• Firewall rules: Block external access to the web management ports (typically 80, 443, 8080) at the network edge.
• Disable remote management if it is not absolutely necessary for operations.
• Change all administrative credentials to strong, unique passwords immediately. Disable the default admin user if possible.
• Monitor camera traffic: Alert on any NetCheckPing URI access and on any outbound connections from the camera to unexpected hosts.

2. Patch/Upgrade Steps when available

• When Tenda releases an updated firmware that addresses CVE-2026-86149, test the firmware in a non-production camera, then apply to all devices.
• Maintain a firmware version inventory for all cameras on the network.

3. Long-Term Hardening

• Replace affected devices: If Tenda is unresponsive and the device model is EOL (end-of-life), plan to replace Tenda CP3 units with a security-hardened vendor that provides regular firmware maintenance.
• Zero-trust architecture: Assume IoT devices are hostile. Place them behind a dedicated IoT gateway that performs deep packet inspection.
• Security monitoring: Deploy the Sigma/Suricata/Elastic rules above to detect attack attempts.
• Vendor communication: Contact Tenda support to request a firmware fix; track the vendor advisory page.
• Physical security review: Since these are surveillance cameras, evaluate the physical security risk if the camera is rendered inoperative or feeds compromised.
• Credential hygiene: Ensure that all administrative accounts used in IoT fleet management are rotated regularly and never shared across devices.

References

1. NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-86149 — Official NVD description and CVSS vector.
2. Tenda CP3 official product page — https://www.tenda.com.cn/product/CP3.html — Vendor product documentation and any (absent) security advisory.
3. CWE-77 Command Injection — https://cwe.mitre.org/data/definitions/77.html — Vulnerability class reference.
4. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-86149 is NOT currently listed; monitor for inclusion.
5. FIRST.org EPSS — https://www.first.org/epss/ — CVE-2026-86149 is not yet scored; revisit for exploitation probability estimations.

No threat actor campaigns or exploit-in-the-wild evidence exists at the time of writing. The absence of public exploit code does not guarantee absence of private exploitation. Monitor Shodan and similar tools for internet-exposed Tenda CP3 devices — those are the highest-risk targets.