Submit #895353: Tenda CP3 V3.2 V27.5.57.101 OS Command Injection

A vulnerability was found in Tenda CP3 V3.2 firmware V27.5.57.101 (ChipType AX_520). The main application binary Kylin implements automatic Wi-Fi pairing/NVR association logic in Functions/AutoAddWifi.cpp.

CAutoAddWifi::ThreadProc at function 0xA6CA0 builds shell commands and executes them via the shared shell wrapper sub_2F77E8 (SystemAsh: vsnprintf + execl /bin/ash -c), including:

echo 0 %s > /proc/net/rtl8192fu/wlan0/nvr_info
echo %s > /proc/net/rtl8192fu/wlan0/ipc_info

Log strings in the same function reference ssid, pass, mac and related pairing fields. If values written into the echo format arguments can be influenced by attacker-controlled pairing/discovery data (for example during SoftAP provisioning, NVR auto-add, or related wireless association flows), shell metacharacters may lead to OS command injection in the Kylin process context (typically root).

Example command shape:
echo 0 aa:bb:cc;id;# > /proc/net/rtl8192fu/wlan0/nvr_info

Identification method: reverse engineering of the official firmware with IDA Pro and Hex-Rays. End-to-end confirmation of a remote unauthenticated trigger on physical hardware was not completed at reporting time.

Affected component: user-x/bin/Kylin, SHA256 bf57a1faae3160277bb298387ad870152b352fba0892457c160dca8d8e29b4d1. Related symbols/strings: CAutoAddWifi, AutoAddWifi.cpp, nvr_info, ipc_info.

This is not a duplicate of the separately reported CP3 V3.2 SoftAP hard-coded password issue, cloud AlarmVoiceURL injection, ATE injection, NetCheckPing injection, or ifconfig/ip rule injection, nor of CVE-2023-30353, CVE-2025-5763, or CVE-2026-516xx. Different code path (AutoAddWifi echo via SystemAsh).

• User: FengZi (UID 98139)
• Submission: 07/19/2026 09:16 (2 months ago)
• Moderation: 09/05/2026 09:40 (2 months later)
• Status: Accepted
• VulDB entry: 399275 [Tenda CP3 27.5.57.101 Kylin AutoAddWifi.cpp CAutoAddWifi::ThreadProc os command injection]
• Points: 17