| عنوان | Tenda Tenda Multiple IP Cameras Multiple Versions Command Injection |
|---|
| الوصف | Affected Version:
Tenda smart camera firmware using the ZhiLing/Kylin OEM solution.
Verified affected versions include:
- CH series:
- CH10: V26.4.41.36
- CH7: V26.5.59.2
- CH7G: V26.5.60.2
- CP series:
- CP3: V22.5.4.110, V27.5.52.11, V27.5.52.17, V27.5.57.17
- CP3 Pro: V21.7.17.111
- CP7: V26.5.45.17
- TC3 series:
- TC3B14C: V25.4.25.53, V25.4.42.20, V25.4.42.21
- TC3B15C: V25.4.26.52, V25.4.26.53
- TC3T14C: V25.4.43.20
- TC3T15C: V25.4.43.21
Potentially affected scope:Tenda smart camera firmware versions using the same ZhiLing/Kylin OEM architecture, including firmware released after November 2025, unless the vendor has redesigned the underlying Kylin/ATE module.
A command injection vulnerability exists in the `Kylin` binary included in Tenda smart camera firmware. In the analyzed firmware sample, the vulnerable code path is located around function address `0x926A8`, which is responsible for handling ATE-related commands.
An attacker can send a crafted JSON packet to the device over UDP port `7320`. After receiving UDP data, the `CAte::HandleCmd` function directly proceeds to JSON parsing and command handling without authentication, token verification, or IP-based access control. User-controlled fields parsed from the JSON payload are formatted into system command strings through `snprintf` and are subsequently executed by the `ATE_SetCmd` function via `popen`.
Because the user-controlled input is not properly validated, sanitized, or escaped before entering the command execution chain, an attacker can inject shell metacharacters and alter the intended command flow. Successful exploitation may allow an unauthenticated network attacker to execute arbitrary system commands on the affected device, potentially leading to device compromise, information disclosure, or further system manipulation. |
|---|
| المصدر | ⚠️ https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/tree/main/Tenda%20Command%20Injection |
|---|
| المستخدم | Howitouchyou (UID 99230) |
|---|
| ارسال | 25/06/2026 04:38 AM (2 أشهر منذ) |
|---|
| الاعتدال | 13/08/2026 04:39 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 389498 [Tenda CH7 حتى 20260625 ATE Module Kylin CAte::HandleCmd تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|