| 제목 | Tenda CP3 V3.2 V27.5.57.101 OS Command Injection |
|---|
| 설명 | A vulnerability was found in Tenda CP3 V3.2 firmware V27.5.57.101 (ChipType AX_520). The main application binary Kylin implements automatic Wi-Fi pairing/NVR association logic in Functions/AutoAddWifi.cpp.
CAutoAddWifi::ThreadProc at function 0xA6CA0 builds shell commands and executes them via the shared shell wrapper sub_2F77E8 (SystemAsh: vsnprintf + execl /bin/ash -c), including:
echo 0 %s > /proc/net/rtl8192fu/wlan0/nvr_info
echo %s > /proc/net/rtl8192fu/wlan0/ipc_info
Log strings in the same function reference ssid, pass, mac and related pairing fields. If values written into the echo format arguments can be influenced by attacker-controlled pairing/discovery data (for example during SoftAP provisioning, NVR auto-add, or related wireless association flows), shell metacharacters may lead to OS command injection in the Kylin process context (typically root).
Example command shape:
echo 0 aa:bb:cc;id;# > /proc/net/rtl8192fu/wlan0/nvr_info
Identification method: reverse engineering of the official firmware with IDA Pro and Hex-Rays. End-to-end confirmation of a remote unauthenticated trigger on physical hardware was not completed at reporting time.
Affected component: user-x/bin/Kylin, SHA256 bf57a1faae3160277bb298387ad870152b352fba0892457c160dca8d8e29b4d1. Related symbols/strings: CAutoAddWifi, AutoAddWifi.cpp, nvr_info, ipc_info.
This is not a duplicate of the separately reported CP3 V3.2 SoftAP hard-coded password issue, cloud AlarmVoiceURL injection, ATE injection, NetCheckPing injection, or ifconfig/ip rule injection, nor of CVE-2023-30353, CVE-2025-5763, or CVE-2026-516xx. Different code path (AutoAddWifi echo via SystemAsh). |
|---|
| 사용자 | FengZi (UID 98139) |
|---|
| 제출 | 2026. 07. 19. AM 09:16 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 05. AM 09:40 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 399275 [Tenda CP3 27.5.57.101 Kylin AutoAddWifi.cpp CAutoAddWifi::ThreadProc 권한 상승] |
|---|
| 포인트들 | 17 |
|---|