| Titel | Tenda CP3 V3.2 V27.5.57.101 OS Command Injection |
|---|
| Beschreibung | A vulnerability was found in Tenda CP3 V3.2 firmware V27.5.57.101 (ChipType AX_520). The main application binary Kylin applies network configuration by building shell commands and executing them via the shared shell wrapper sub_2F77E8 (Apis/system.c, SystemAsh: vsnprintf + execl /bin/ash -c).
Two representative sinks were confirmed by reverse engineering:
1) Interface MTU/up-down handling at function 0xA92DC constructs and executes:
ifconfig %s down
ifconfig %s mtu %d
ifconfig %s up
where the interface name is inserted into the format string without demonstrated shell metacharacter filtering.
2) Policy routing handling at function 0xBE58A constructs and executes commands such as:
ip rule add from %s table %d
ip rule add to %s table %d
ip rule add dev %s table %d
ip rule del from/to/dev %s table %d
and related ip route add/del lines
using address, device, and table parameters passed into snprintf then sub_2F77E8.
These helpers sit under network management call chains (callers include 0xBEE1C, 0xBF66C, 0xBF244, 0xC0B58 and related functions). If configuration values that feed these parameters can be influenced through administrative network settings (for example authenticated Web/RPC configuration such as configManager.setConfig Network/Wireless paths), an attacker may achieve OS command injection as the Kylin process (typically root).
Example command shapes:
ifconfig wlan0;id;# up
ip rule add from x.x.x.x;id;# table 100
Identification method: reverse engineering of the official firmware with IDA Pro and Hex-Rays. End-to-end confirmation of a specific unfiltered RPC field to these sinks on physical hardware was not completed at reporting time.
Affected component: user-x/bin/Kylin, SHA256 bf57a1faae3160277bb298387ad870152b352fba0892457c160dca8d8e29b4d1.
This is not a duplicate of the separately reported CP3 V3.2 issues for cloud AlarmVoiceURL wget injection, ATE popen injection, or NetCheckPing injection, nor of CVE-2023-30353, CVE-2025-5763, or CVE-2026-516xx. Same product firmware, different code paths and sinks (ifconfig/ip rule via SystemAsh). |
|---|
| Benutzer | FengZi (UID 98139) |
|---|
| Einreichung | 19.07.2026 09:15 (vor 2 Monaten) |
|---|
| Moderieren | 05.09.2026 09:40 (2 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 399274 [Tenda CP3 27.5.57.101 Network Configuration Management Apis/system.c sub_2F77E8 erweiterte Rechte] |
|---|
| Punkte | 17 |
|---|