Gửi #868463: Tenda Tenda Multiple IP Cameras Multiple Versions Command Injection

Affected Version:
Tenda smart camera firmware using the ZhiLing/Kylin OEM solution.
Verified affected versions include:
- CH series:
- CH10: V26.4.41.36
- CH7: V26.5.59.2
- CH7G: V26.5.60.2
- CP series:
- CP3: V22.5.4.110, V27.5.52.11, V27.5.52.17, V27.5.57.17
- CP3 Pro: V21.7.17.111
- CP7: V26.5.45.17
- TC3 series:
- TC3B14C: V25.4.25.53, V25.4.42.20, V25.4.42.21
- TC3B15C: V25.4.26.52, V25.4.26.53
- TC3T14C: V25.4.43.20
- TC3T15C: V25.4.43.21
Potentially affected scope:Tenda smart camera firmware versions using the same ZhiLing/Kylin OEM architecture, including firmware released after November 2025, unless the vendor has redesigned the underlying Kylin/ATE module.
A command injection vulnerability exists in the `Kylin` binary included in Tenda smart camera firmware. In the analyzed firmware sample, the vulnerable code path is located around function address `0x926A8`, which is responsible for handling ATE-related commands.
An attacker can send a crafted JSON packet to the device over UDP port `7320`. After receiving UDP data, the `CAte::HandleCmd` function directly proceeds to JSON parsing and command handling without authentication, token verification, or IP-based access control. User-controlled fields parsed from the JSON payload are formatted into system command strings through `snprintf` and are subsequently executed by the `ATE_SetCmd` function via `popen`.
Because the user-controlled input is not properly validated, sanitized, or escaped before entering the command execution chain, an attacker can inject shell metacharacters and alter the intended command flow. Successful exploitation may allow an unauthenticated network attacker to execute arbitrary system commands on the affected device, potentially leading to device compromise, information disclosure, or further system manipulation.

• Nguồn: ⚠️ https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/tree/main/Tenda%20Command%20Injection
• Người dùng: Howitouchyou (UID 99230)
• Đệ trình: 25/06/2026 04:38 (cách đây 2 các tháng)
• Kiểm duyệt: 13/08/2026 16:39 (2 months later)
• Trạng thái: được chấp nhận
• Mục VulDB: 389498 [Tenda CH7 đến 20260625 ATE Module Kylin CAte::HandleCmd nâng cao đặc quyền]
• điểm: 20