CVE-2026-86153

Executive Summary

CVE-2026-86153 is a critical remote privilege management vulnerability (CVSS 9.1) in the Tenda CP3 network device, firmware version 27.5.57.101. The flaw resides in the CRedirServer::SetRedirectEnable function, which is part of the Functions/Redirect.cpp file, and allows an attacker with high-privilege credentials to perform improper privilege management actions that can lead to full system compromise. Because the affected component is remotely reachable, enterprise networks and SMBs that deploy Tenda CP3 devices are at direct risk of takeover, lateral movement, and data exfiltration. As of this writing, no official patch exists, making immediate mitigation mandatory for affected deployments.

Vendor: Tenda | Affected Product: Tenda CP3 (firmware 27.5.57.101) | CVSS: 9.1 (Critical)

Technical Analysis

This vulnerability exists in the Tenda CP3 device's firmware version 27.5.57.101, specifically in a function of the CRedirServer class called SetRedirectEnable. The class itself is defined in Functions/Redirect.cpp. Per the NVD description, the manipulation leads to "improper privilege management" (CWE-266), which indicates that the software does not correctly ensure that a user has the required privileges before executing an operation.

The precise flaw mechanism: The SetRedirectEnable function processes a remote request that enables or disables traffic redirection. The attack vector is network-based (AV:N), and the attack complexity is low (AC:L). Importantly, the condition requires high privileges (PR:H) — authentication as an administrator is presumably required — but the lack of separation between privilege levels means that once a request reaches this function, the device executes the action without validating whether the action itself should require a higher hierarchy of privileges than what the caller possesses. In effect, the function acts as a "privilege boundary bypass": a high-privileged user (e.g., a guest admin with limited scope) could potentially invoke operations that were meant only for a super-admin/full-root context.

Attack surface: Since this is a routing/redirect management module in a network appliance, the affected function is exposed on the device's management interface (HTTP/HTTPS-based web server). Remote exploitation is confirmed by the NVD vector (AV:N). The network availability means that an attacker who has obtained low-level admin credentials (through credential stuffing, leaked default passwords, etc.) could leverage this to escalate within the device's privilege model.

Technical note: The NVD description contains a single code reference (CRedirServer::SetRedirectEnable in Functions/Redirect.cpp); no other function names, endpoints, or parameters are disclosed. The report deliberately refrains from hypothesizing about additional code implementation details.

Exploitation Scenarios

No public PoC exists for this CVE. The following chain is inferred strictly from the vulnerability class (CWE-266 — Improper Privilege Management) and the NVD description. No exploit code or Nuclei template exists.

Step 1 — Reconnaissance / Target Identification:
The attacker scans the Internet for Tenda CP3 devices. Typical targeting uses Shodan/Censys queries for title:"Tenda" or product:"CP3", or scans port 80/443 on home/edge networks. Once a target is identified, the attacker performs a banner grab to confirm firmware version 27.5.57.101 (via the login page or device info endpoint).

Step 2 — Triggering the Specific Flaw Class:
The attacker authenticates to the device management portal (username/password). Since the CVSS score indicates a required high-privileged (PR:H) session, the attacker must obtain administrator credentials — via default credentials (many Tenda devices ship with admin/admin), credential brute-force, or reuse of leaked credentials. However, CWE-266 suggests that once authenticated, the attacker can call the CRedirServer::SetRedirectEnable function with a crafted request that manipulates redirect settings. The flaw is that the function does not enforce a second privilege boundary — the action is performed based on the already-established session, regardless of whether the session context allows redirect policy changes.

Step 3 — Payload/Execution Method:
At the class level, the payload consists of an HTTP request to the redirect management module (invoked via the affected function). The specific parameters are not disclosed, but the functional manipulation changes the redirect configuration state of the device. No remote code execution is required; the impact comes from the improper privilege escalation inside the device's application context — changing redirection rules can reroute internal network traffic (turning the device into a MITM point) or disable security filters that depended on redirection policies.

Step 4 — Post-Exploitation Impact:
The CVSS vector shows Impact: Confidentiality/Integrity/Availability all High (C:H/I:H/A:H) with Scope: Changed (S:C). A changed scope means the impact of this vulnerability extends beyond the vulnerable component — i.e., an attacker who successfully calls the redirect-manipulation function can affect other parts of the network beyond this single device. The blast radius: the device can be used as a pivot point, used to redirect traffic toward attacker-controlled destinations (enabling credential harvesting of all transit traffic), or disrupted entirely to cause DoS on the local network the CP3 serves. Because no patch exists, and the device likely holds network-level trust, this represents a significant network compromise risk, not just a device compromise.

Impact Assessment

Business Risk: Critical.

The CVSS score of 9.1 with a Scope-Changed vector (S:C) signals that the flaw is exploitable remotely with minimal complexity (AC:L) but requires an authenticated high privilege session. Once triggered, the impact on the hosting network is severe — confidentiality, integrity, and availability are all rated high. An attacker who exploits this can:

1. Reroute or intercept traffic on the local network segment the Tenda CP3 manages (if deployed as a wireless router or gateway, this means all client traffic).
2. Achieve lateral movement — the device may be in a trust zone where other appliances (switches, firewalls, local servers) accept traffic relayed from it as legitimate.
3. Deny service by modifying redirect tables to blackhole traffic.
4. Pivot to other network appliances since no patch is available and the vulnerability is unpatched in all tracked sources.

Affected Systems: All Tenda CP3 devices running firmware 27.5.57.101. Only this build is explicitly listed in the NVD description; until a vendor advisory confirms otherwise, assume all prior and later versions of the CP3 line share this or a similar flaw until patched. Affected deployments: SMB branch offices, remote workers, small campuses.

Blast Radius: When considering the Scope:Changed, a single compromised CP3 can directly impact the entire management VLAN and the network traffic passing through it. However, note the CVSS precondition PR:H limits an initial attacker to having existing admin credentials. This reduces the likelihood of mass unauthenticated exploitation but does not reduce the severity rating, given the broad impact post-authentication.

Detection Guidance

Generating direct detection rules for this CVE is challenging because no specific URL, payload, or indicator is public. The detection strategies below focus on (a) anomalous administrative activity on Tenda CP3 devices, and (b) generic detection of exploitation attempts targeting the redirect-management module.

Sigma Rule

title: Tenda CP3 Redirect Module Admin Activity
id: b3d31a5e-4e2c-4a9f-9f35-7d3f27a486e1
status: experimental
description: Detects administrative access and configuration changes on Tenda CP3 devices that may indicate exploitation of CVE-2026-86153.
author: ValtersIT Threat Intel
logsource:
  category: application
  product: network
detection:
  selection_source:
    src_ip:
      - "10.0.0.0/8"
      - "192.168.0.0/16"
      - "172.16.0.0/12"
  selection_target:
    dest_ip:
    - "or"
    - "network"
    - "device"
  selection_http:
    http.url|contains: "redirect"
    http.response.status_code: 200
    http.http_user_agent|contains: "admin"
  selection_auth:
    category: authentication
    action: success
    user|contains: "admin"
  timeframe: 5m
  condition: selection_auth and (selection_http) and selection_target
falsepositives:
  - Legitimate administrative changes to redirect rules.
level: high

YARA Rule

rule Tenda_CP3_Redirect_CVE_2026_86153 {
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detection of strings referencing the vulnerable function or file for CVE-2026-86153"
        cve = "CVE-2026-86153"
        date = "2026-05-30"
    strings:
        $a = "CRedirServer::SetRedirectEnable" ascii nocase
        $b = "Functions/Redirect.cpp" ascii nocase
        $c = "27.5.57.101" ascii nocase
    condition:
        2 of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"Potential Tenda CP3 Redirect Module Access (CVE-2026-86153)"; flow:established,to_server; http.uri_contains:"redirect"; http.method:"POST"; http.header: "Cookie" | contains "admin"; http.connection_count: any; content:"SetRedirectEnable"; nocase; http.uri; content:"admin"; http.header; sid:202686153; rev:1; metadata:cve CVE-2026-86153; classtype:attempted-admin;)

Explanation — Note: Due to lack of exact endpoint paths, this rule flags any HTTP POST with redirected URI referencing "redirect" content for devices tagged as network hardware. Users should profile their environment and adjust to filter legitimate traffic.

Elastic Detection

// EQL rule: Detects repeated admin calls to redirect management endpoint on network hardware
sequence by host.ip, process.name with maxspan=5m
  [authentication where outcome == "success" and user.name == "admin" and host.vendor == "Tenda"]
  [network where event.category == "http" and url.path contains "redirect" and http.request.method == "POST"]

Splunk SPL Query

index=network sourcetype=weblog OR sourcetype=stream:http
  http_method=POST uri=*redirect*
  | eval vendor="Tenda CP3"
  | stats count by src_ip, dest_ip, uri
  | where user=admin
  | where count > 5
  | table _time, src_ip, dest_ip, uri, count

Wazuh OSSEC Rule

<group name="Tenda">
  <rule id="173858"   level="10">
    <if_sid>99255</if_sid>
    <match>SetRedirectEnable|Redirect.cpp</match>
    <description>Tenda CP3 redirect management access attempt (CVE-2026-86153).</description>
    <group>network,web</group>
  </rule>

  <rule id="173859"   level="12" frequency="5" timeframe="300">
    <if_matched_sid>99255</if_matched_sid>
    <description>Multiple attempts to exploit CVE-2026-86153 detected on Tenda CP3.</description>
    <group>network,web,exploit</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No vendor fix, hotfix, or patch evidence is available from any tracked source. Tenda has not published a fix as of the date of this report. The following measures should be implemented immediately.

1.) Immediate Mitigations (without a vendor patch):

• Segment the device: Place all Tenda CP3 devices on an isolated management VLAN; disallow direct inbound access from WAN interfaces unless operationally required (and even then, only from IP allowlists via firewall rules).
• Restrict source IPs: Enforce firewall rules so that only authorized administrative IPs can reach the management interface. If the interface accepts connections from 0.0.0.0/0, block the protocol (typically TCP 80/443) from all external sources.
• Disable remote management if the device supports a "remote access" or "remote management" toggle — do so immediately.
• Change admin credentials to a strong, unique password. Additionally, rotate the passphrase if the device may have been exposed to the internet (post-exploitation cleanup).
• Disable the redirect module (represented by CRedirServer::SetRedirectEnable interface) from the configuration UI, if such admin override exists.

2.) Patch/Upgrade Path:

• Monitor Tenda's official security advisory channel (tenda.com.cn / tendacn.com) for a firmware upgrade for the CP3 line. Check weekly for the advisory referencing 27.5.57.101.
• Do NOT trust third-party "patched" firmware that appears outside the vendor-released update channels — forced installs without vendor signature can brick the device or introduce backdoors.

3.) Long-Term Hardening:

• Decommission the CP3 if it reaches end-of-life before a patch arrives. Replace it with a vendor that has an active security response program.
• Network monitoring: Apply detection measures described above. Monitor for POST/GET requests to any redirect-related module, especially from low-privilege source networks.
• Vendor tracking: Create a maintenance contract with Tenda directly to receive firmware advisories first-hand.
• Zero-trust: Never treat CP3 as a trusted network boundary; assume it is compromised-capable, and mirror all traffic for inspection, do not rely on the device alone for routing integrity.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-86153 — Official NVD description, CVSS vector and score (9.1), CWE-266.
2. Tenda Vendor Portal: https://www.tenda.com.cn — Target portal to check for upcoming security advisories — NO advisory exists yet as of this report date.
3. MITRE ATT&CK: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application tactic (matches remote exploitation of network device management functions).
4. CWE-266 — Improper Privilege Management: https://cwe.mitre.org/data/definitions/266.html — Class description underlying the flaw.

Threat actor campaigns / in-the-wild evidence: None reported as of the date of this analysis. No exploitation activity, public PoC, or signature for CVE-2026-86153 has surfaced in trusted threat intel feeds. This vulnerability is unpatched and could be targeted by actors focusing on IoT / network appliance exploitation; monitor OT/IoT dark-web chatter for mentions of the Tenda CP3 firmware 27.5.57.101. CISA KEV: NO — not listed.

Report generated 2026-06-XX by ValtersIT Threat Intelligence. Details are derived exclusively from the NVD metadata provided; detection rules are designed to be parameterized to your fleet and may need local tuning.