提交 #868463: Tenda Tenda Multiple IP Cameras Multiple Versions Command Injection信息

标题Tenda Tenda Multiple IP Cameras Multiple Versions Command Injection
描述 Affected Version: Tenda smart camera firmware using the ZhiLing/Kylin OEM solution. Verified affected versions include: - CH series: - CH10: V26.4.41.36 - CH7: V26.5.59.2 - CH7G: V26.5.60.2 - CP series: - CP3: V22.5.4.110, V27.5.52.11, V27.5.52.17, V27.5.57.17 - CP3 Pro: V21.7.17.111 - CP7: V26.5.45.17 - TC3 series: - TC3B14C: V25.4.25.53, V25.4.42.20, V25.4.42.21 - TC3B15C: V25.4.26.52, V25.4.26.53 - TC3T14C: V25.4.43.20 - TC3T15C: V25.4.43.21 Potentially affected scope:Tenda smart camera firmware versions using the same ZhiLing/Kylin OEM architecture, including firmware released after November 2025, unless the vendor has redesigned the underlying Kylin/ATE module. A command injection vulnerability exists in the `Kylin` binary included in Tenda smart camera firmware. In the analyzed firmware sample, the vulnerable code path is located around function address `0x926A8`, which is responsible for handling ATE-related commands. An attacker can send a crafted JSON packet to the device over UDP port `7320`. After receiving UDP data, the `CAte::HandleCmd` function directly proceeds to JSON parsing and command handling without authentication, token verification, or IP-based access control. User-controlled fields parsed from the JSON payload are formatted into system command strings through `snprintf` and are subsequently executed by the `ATE_SetCmd` function via `popen`. Because the user-controlled input is not properly validated, sanitized, or escaped before entering the command execution chain, an attacker can inject shell metacharacters and alter the intended command flow. Successful exploitation may allow an unauthenticated network attacker to execute arbitrary system commands on the affected device, potentially leading to device compromise, information disclosure, or further system manipulation.
来源⚠️ https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/tree/main/Tenda%20Command%20Injection
用户
 Howitouchyou (UID 99230)
提交2026-06-25 04時38分 (2 月前)
管理2026-08-13 16時39分 (2 months later)
状态已接受
VulDB条目389498 [Tenda CH7 直到 20260625 ATE Module Kylin CAte::HandleCmd 权限提升]
积分20

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!