| 제목 | Tenda CP3 V3.2 V27.5.57.101 OS Command Injection |
|---|
| 설명 | A vulnerability was found in Tenda CP3 V3.2 firmware V27.5.57.101 (ChipType AX_520). The main application binary Kylin implements network connectivity checks in Net/NetCheckPing.cpp.
Function 0x12D326 builds a shell command with sprintf using interface name and host parameters and executes it via popen:
ping -W 2 -I %s -c %u %s
If the interface name and/or destination host string are attacker-controlled (for example via network configuration paths that feed NetCheckPing, such as administrative network settings after authentication), shell metacharacters are not shown to be neutralized before popen. This enables OS command injection in the Kylin process context (typically root).
Example command shape: ping -W 2 -I wlan0 -c 1 x.x.x.x;id;#
Callers include functions 0x12D41C, 0x12D4D4, and 0x12DA34.
Identification method: reverse engineering of the official firmware with IDA Pro and Hex-Rays. End-to-end confirmation that a specific Web/RPC field reaches this sink without filtering was not completed on physical hardware at reporting time.
Affected component: user-x/bin/Kylin, SHA256 bf57a1faae3160277bb298387ad870152b352fba0892457c160dca8d8e29b4d1. Related symbols/strings: NetCheckPing, NetCheckPing.cpp, ping -W 2 -I.
This is not a duplicate of CVE-2023-30353 or CVE-2025-5763 (legacy CP3 noodles/apollo platform) or CVE-2026-516xx (CP3 V3.0 V31.1.9.91 RTSP issues). Different product generation, firmware branch, and vulnerable code path (NetCheckPing/popen, not RTSP or cloud AlarmVoiceURL/ATE handlers reported separately). |
|---|
| 사용자 | FengZi (UID 98139) |
|---|
| 제출 | 2026. 07. 19. AM 09:13 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 05. AM 09:40 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 399272 [Tenda CP3 27.5.57.101 Net/NetCheckPing.cpp interface_name/host 권한 상승] |
|---|
| 포인트들 | 17 |
|---|