CVE-2026-19747 is a critical command injection vulnerability affecting several Tenda router models (CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C, TC3T15C) up to the 20260625 build. The vulnerability arises from improper input handling in the CAte::HandleCmd function of the ATE Module's Kylin component, enabling remote unauthenticated attackers to inject and execute arbitrary commands on the device. This can lead to full compromise of the affected device.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected Tenda devices without authentication, potentially leading to full device compromise, disruption of network services, or unauthorized access to network traffic. The vulnerability has a CVSS 4.0 score of 9.3, reflecting high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users should monitor Tenda's official channels for updates and apply patches as soon as they become available. Until then, restricting remote access to affected devices and disabling unnecessary services may reduce exposure.