| Titre | Tenda Tenda Multiple IP Cameras Multiple Versions Authentication Bypass |
|---|
| Description | Affected Version：
Tenda smart camera firmware using the ZhiLing/Kylin OEM firmware architecture and the /user/bin/Kylin web service component.
Verified affected products and firmware versions include, but are not limited to:
Tenda CH10: V26.4.41.36
Tenda CH7 / CH7G: V26.5.59.2, V26.5.60.2
Tenda CP3 / CP3 Pro / CP7: V22.5.4.110, V27.5.52.11, V27.5.52.17, V27.5.57.17, V21.7.17.111, V26.5.45.17
Tenda TC3 series, including TC3B14C, TC3B15C, TC3T14C, and TC3T15C: V25.4.25.53, V25.4.42.20, V25.4.42.21, V25.4.26.52, V25.4.26.53, V25.4.43.20, V25.4.43.21
Other Tenda smart camera firmware versions based on the same ZhiLing/Kylin OEM web service implementation may also be affected.
Vulnerability Description
A predictable session management vulnerability exists in the web management service of Tenda smart cameras based on the ZhiLing/Kylin OEM firmware architecture.
The affected firmware uses a simple integer value as the web administrator SESSION cookie. The session value is parsed directly from the HTTP Cookie header in the format SESSION=%d, and the login handler returns the session token in the same integer format through Set-Cookie: SESSION=%d.
Because the session identifier has insufficient entropy and lacks effective anti-bruteforce protection, an attacker who can access the camera web interface may enumerate or guess a valid administrator session. When a valid session is found, the attacker can access authenticated Web APIs as the administrator without knowing the correct password.
Successful exploitation allows the attacker to obtain Web administrator privileges and operate sensitive camera functions, such as modifying security configuration, enabling debugging interfaces, disabling RTSP authentication, disabling ONVIF authentication, or performing other administrative actions. This issue may also be chained with other vulnerabilities to further compromise the device. |
|---|
| La source | ⚠️ https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/tree/main/Tenda%20Weak%20Bypass |
|---|
| Utilisateur | Howitouchyou (UID 99230) |
|---|
| Soumission | 25/06/2026 05:05 (il y a 2 mois) |
|---|
| Modérer | 13/08/2026 16:39 (2 months later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 389499 [Tenda CH7 jusqu’à 20260625 Kylin Web Service /user/bin/Kylin CWebSessionManager_ParseSession SESSION chiffrement faible] |
|---|
| Points | 20 |
|---|