CVE-2026-19748

LOW 3.7

Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManager_ParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument SESSION leads to insufficient entropy. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is told to be difficult.

CWE	CWE-331 CWE-330
Vendor	tenda
Product	ch7
Published	Aug 13, 2026

Stay Ahead of the Next One

Get instant alerts for tenda ch7

Be the first to know when new low vulnerabilities affecting tenda ch7 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Tenda / CH7

20260625

Tenda / CH7G

20260625

Tenda / CH10

20260625

Tenda / CP3

20260625

Tenda / CP3 Pro

20260625

Tenda / CP7

20260625

Tenda / TC3B14C

20260625

Tenda / TC3B15C

20260625

Tenda / TC3T14C

20260625

Tenda / TC3T15C

20260625

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/389499 vuldb.com: https://vuldb.com/vuln/389499/cti vuldb.com: https://vuldb.com/cve/CVE-2026-19748 vuldb.com: https://vuldb.com/submit/868490 github.com: https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20Weak%20Bypass/Tenda%20Camera%20Weak%20Session%20Authentication%20Bypass.md tenda.com.cn: https://www.tenda.com.cn/

Credits

🔍 Howitouchyou (VulDB User)