CVE-2026-86152

CRITICAL 10.0

Tenda CP3 Kylin AutoAddWifi.cpp ThreadProc os command injection

CVSS Score

10.0

EPSS Score

0.0%

EPSS Percentile

0th

A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The attack may be launched remotely.

CWE	CWE-78 CWE-77
Vendor	tenda
Product	cp3
Published	Sep 6, 2026
Last Updated	Sep 10, 2026

Stay Ahead of the Next One

Get instant alerts for tenda cp3

Be the first to know when new critical vulnerabilities affecting tenda cp3 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:X/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Tenda / CP3

27.5.57.101

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/399275 vuldb.com: https://vuldb.com/vuln/399275/cti vuldb.com: https://vuldb.com/cve/CVE-2026-86152 vuldb.com: https://vuldb.com/submit/895353 tenda.com.cn: https://www.tenda.com.cn/

Credits

🔍 FengZi (VulDB User) VulDB Vulnerability Moderation Team