CVE-2026-86151: OS Command Injection in Tenda CP3

CVE-2026-86151 is a critical OS command injection vulnerability found in Tenda CP3 version 27.5.57.101. The vulnerable code resides in the function sub_2F77E8 of Apis/system.c, part of the Network Configuration Management component. An attacker with high privileges can remotely manipulate this function to execute arbitrary OS commands, potentially compromising the device. The CVSS 3.1 base score is 9.1, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.

Successful exploitation allows a remote attacker with high privileges to execute arbitrary operating system commands on the affected device, leading to full compromise of confidentiality, integrity, and availability of the system. This could result in unauthorized control over the device and disruption of network configuration management.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected device to trusted administrators only and monitor for suspicious activity related to network configuration management functions.