| Titre | Tenda CP3 V3.2 V27.5.57.101 OS Command Injection |
|---|
| Description | A vulnerability was found in Tenda CP3 V3.2 firmware V27.5.57.101 (ChipType AX_520). The main application binary Kylin processes cloud property updates for sound/light alarm configuration (CCloudMsg Property_SoundLightAlarmConfig).
When the AlarmVoiceURL field is set, function 0x52638 builds shell commands with sprintf and executes them via the shared shell wrapper sub_2F77E8 (Apis/system.c, SystemAsh). The wrapper uses vsnprintf and runs the command with vfork and execl of /bin/ash -c (or /bin/bash if present).
The code constructs: wget -O /opt/sav/DIYAudio.aac <AlarmVoiceURL> and also runs rm on related paths via the same wrapper. If AlarmVoiceURL contains shell metacharacters, an attacker who can control this cloud property (for example via a compromised or malicious cloud-side update for a bound device) can achieve OS command injection in the Kylin process context (typically root).
Example command shape: wget -O /opt/sav/DIYAudio.aac http://example/;id;#
Identification method: reverse engineering of the official firmware with IDA Pro and Hex-Rays. Runtime exploitation on physical hardware was not completed at the time of this report.
Affected component: user-x/bin/Kylin, SHA256 bf57a1faae3160277bb298387ad870152b352fba0892457c160dca8d8e29b4d1. Related symbols/strings: AlarmVoiceURL, DIYAudio.aac, Property_SoundLightAlarmConfig, cloud_msg.cpp.
This is not a duplicate of CVE-2023-30353 or CVE-2025-5763 (legacy CP3 noodles/apollo platform) or CVE-2026-516xx (CP3 V3.0 V31.1.9.91 RTSP issues). Different product generation, firmware branch, and vulnerable code path. |
|---|
| Utilisateur | FengZi (UID 98139) |
|---|
| Soumission | 19/07/2026 09:12 (il y a 2 mois) |
|---|
| Modérer | 05/09/2026 09:40 (2 months later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 399271 [Tenda CP3 27.5.57.101 Kylin Apis/system.c SystemAsh AlarmVoiceURL élévation de privilèges] |
|---|
| Points | 17 |
|---|