CVE-2026-86151: OS Command Injection in Tenda CP3

This vulnerability exists in Tenda CP3 version 27.5.57.101, specifically in the function sub_2F77E8 of Apis/system.c related to Network Configuration Management. An attacker can remotely manipulate inputs to trigger OS command injection, potentially executing arbitrary commands on the device. The CVSS 4.0 base score is 9.4, indicating critical severity with network attack vector, low attack complexity, no user interaction, and requiring high privileges. The vulnerability impacts confidentiality, integrity, availability, system confidentiality, integrity, and availability, and scope is changed.

Successful exploitation could allow a remote attacker with high privileges to execute arbitrary operating system commands on the affected device, potentially leading to full compromise of the device's confidentiality, integrity, and availability. This could disrupt network configuration and device operation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to the affected device's management interfaces to trusted users only and monitor for suspicious activity.