| Titre | Tenda CP3 V3.2 V27.5.57.101 OS Command Injection |
|---|
| Description | A vulnerability was found in Tenda CP3 V3.2 firmware V27.5.57.101 (ChipType AX_520). The main application binary Kylin contains a factory/ATE (Automatic Test Equipment) subsystem implemented in Functions/Ate.cpp.
The ATE command handler path includes CAte::HandleCmd (function 0xAE614) and related helpers. ATE_SetCmd at address 0xAB63C passes an attacker-influenced command string directly to popen(cmd, "r") without adequate sanitization. Additional ATE helpers build shell commands with format strings such as rtwpriv wlan0 efuse_file %s and similar rtwpriv/ifconfig templates, then execute them via popen or the shared shell wrapper sub_2F77E8 (SystemAsh: vsnprintf + execl /bin/ash -c).
CAte::ThreadProc (function 0xB6794) starts ATE-related logic involving ez_udp_server, files under /tmp/ateState and /mnt/sdcard/ate, and can execute constructed commands including wpa_supplicant launch lines and fw_setenv xuart. If the ATE interface is reachable on a production or test-enabled device (UDP/file-driven test mode), an attacker on the local network or with access to the ATE input channel may achieve OS command execution as the Kylin process (typically root).
Identification method: reverse engineering of the official firmware with IDA Pro and Hex-Rays. Whether ATE is enabled by default on retail devices and the exact network exposure were not fully confirmed on physical hardware at reporting time.
Affected component: user-x/bin/Kylin, SHA256 bf57a1faae3160277bb298387ad870152b352fba0892457c160dca8d8e29b4d1. Related symbols/strings: CAte::HandleCmd, CAte::ThreadProc, ATE_SetCmd, rtwpriv, /tmp/ateState, Ate.cpp.
This is not a duplicate of CVE-2023-30353 or CVE-2025-5763 (legacy CP3 noodles/apollo platform) or CVE-2026-516xx (CP3 V3.0 V31.1.9.91 RTSP issues). Different product generation, firmware branch, and vulnerable code path (ATE/popen, not RTSP or legacy XML handlers). |
|---|
| Utilisateur | FengZi (UID 98139) |
|---|
| Soumission | 19/07/2026 09:13 (il y a 2 mois) |
|---|
| Modérer | 05/09/2026 09:35 (2 months later) |
|---|
| Statut | Dupliqué |
|---|
| Entrée VulDB | 389498 [Tenda CH7 jusqu’à 20260625 ATE Module Kylin CAte::HandleCmd élévation de privilèges] |
|---|
| Points | 0 |
|---|