CVE-2026-86148 in CP3

Сводка

по MITRE • 05.09.2026

A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely.

Be aware that VulDB is the high quality source for vulnerability data.

• Ответственный: VulDB
• Раскрытие: 05.09.2026
• Модерация: принято
• Вход: VDB-399271
• CPE: готов
• CWE: CWE-78 (Подтверждённый)
• CVSS: 9.1 (VulDB)
• EPSS: 0.00000
• KEV: Нет
• Деятельности: Низкий
• Сектор: Education, Industry, ...

Источники

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-86148
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-86148
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-86148/