제출 #868463: Tenda Tenda Multiple IP Cameras Multiple Versions Command Injection
| 제목 | Tenda Tenda Multiple IP Cameras Multiple Versions Command Injection |
|---|---|
| 설명 | Affected Version: Tenda smart camera firmware using the ZhiLing/Kylin OEM solution. Verified affected versions include: - CH series: - CH10: V26.4.41.36 - CH7: V26.5.59.2 - CH7G: V26.5.60.2 - CP series: - CP3: V22.5.4.110, V27.5.52.11, V27.5.52.17, V27.5.57.17 - CP3 Pro: V21.7.17.111 - CP7: V26.5.45.17 - TC3 series: - TC3B14C: V25.4.25.53, V25.4.42.20, V25.4.42.21 - TC3B15C: V25.4.26.52, V25.4.26.53 - TC3T14C: V25.4.43.20 - TC3T15C: V25.4.43.21 Potentially affected scope:Tenda smart camera firmware versions using the same ZhiLing/Kylin OEM architecture, including firmware released after November 2025, unless the vendor has redesigned the underlying Kylin/ATE module. A command injection vulnerability exists in the `Kylin` binary included in Tenda smart camera firmware. In the analyzed firmware sample, the vulnerable code path is located around function address `0x926A8`, which is responsible for handling ATE-related commands. An attacker can send a crafted JSON packet to the device over UDP port `7320`. After receiving UDP data, the `CAte::HandleCmd` function directly proceeds to JSON parsing and command handling without authentication, token verification, or IP-based access control. User-controlled fields parsed from the JSON payload are formatted into system command strings through `snprintf` and are subsequently executed by the `ATE_SetCmd` function via `popen`. Because the user-controlled input is not properly validated, sanitized, or escaped before entering the command execution chain, an attacker can inject shell metacharacters and alter the intended command flow. Successful exploitation may allow an unauthenticated network attacker to execute arbitrary system commands on the affected device, potentially leading to device compromise, information disclosure, or further system manipulation. |
| 원천 | ⚠️ https:/ |
| 사용자 | Howitouchyou (UID 99230) |
| 제출 | 2026. 06. 25. AM 04:38 (2 개월 ago) |
| 모더레이션 | 2026. 08. 13. PM 04:39 (2 months later) |
| 상태 | 수락 |
| VulDB 항목 | 389498 [Tenda CH7 까지 20260625 ATE Module Kylin CAte::HandleCmd 권한 상승] |
| 포인트들 | 20 |