| Titel | Tenda CP3 V3.2 V27.5.57.101 Improper Access Controls |
|---|
| Beschreibung | A vulnerability was found in Tenda CP3 V3.2 firmware V27.5.57.101 (ChipType AX_520). The main application binary Kylin implements a redirect/debug control path in Functions/Redirect.cpp.
CRedirServer::SetRedirectEnable at function 0x82AF8 enables or disables a redirect mode and modifies the U-Boot environment variable xuart. The function runs:
popen("fw_printenv | grep xuart", "r")
and, depending on the enable flag, executes via the shared shell wrapper sub_2F77E8 (SystemAsh):
fw_setenv xuart 0
fw_setenv xuart 1
then schedules a reboot about 2 seconds later. Setting xuart can alter serial/UART debug exposure on the device after reboot, weakening the hardware/debug security boundary and facilitating local console-based attacks.
Caller evidence includes function 0x69228. If SetRedirectEnable can be invoked through management interfaces without sufficient authorization checks (or by an authenticated but low-privilege operator where debug enablement should be restricted), an attacker may force UART/debug-related environment changes and reboot the device.
Identification method: reverse engineering of the official firmware with IDA Pro and Hex-Rays. End-to-end confirmation of the exact RPC/API authorization model on physical hardware was not completed at reporting time.
Affected component: user-x/bin/Kylin, SHA256 bf57a1faae3160277bb298387ad870152b352fba0892457c160dca8d8e29b4d1. Related symbols/strings: CRedirServer::SetRedirectEnable, SetRedirectEnable, fw_setenv xuart, Redirect.cpp.
This is not a duplicate of the separately reported CP3 V3.2 OS command injection issues (cloud AlarmVoiceURL, ATE, NetCheckPing, ifconfig/ip rule, AutoAddWifi) or the SoftAP hard-coded password issue, nor of CVE-2023-30354 (legacy CP3 physical UART/U-Boot access on a different platform). This report documents a firmware logic path that programmatically enables xuart via fw_setenv and reboot on CP3 V3.2 V27.5.57.101. |
|---|
| Benutzer | FengZi (UID 98139) |
|---|
| Einreichung | 19.07.2026 09:17 (vor 2 Monaten) |
|---|
| Moderieren | 05.09.2026 09:41 (2 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 399276 [Tenda CP3 27.5.57.101 Functions/Redirect.cpp SetRedirectEnable erweiterte Rechte] |
|---|
| Punkte | 17 |
|---|