提交 #868463: Tenda Tenda Multiple IP Cameras Multiple Versions Command Injection
| 标题 | Tenda Tenda Multiple IP Cameras Multiple Versions Command Injection |
|---|---|
| 描述 | Affected Version: Tenda smart camera firmware using the ZhiLing/Kylin OEM solution. Verified affected versions include: - CH series: - CH10: V26.4.41.36 - CH7: V26.5.59.2 - CH7G: V26.5.60.2 - CP series: - CP3: V22.5.4.110, V27.5.52.11, V27.5.52.17, V27.5.57.17 - CP3 Pro: V21.7.17.111 - CP7: V26.5.45.17 - TC3 series: - TC3B14C: V25.4.25.53, V25.4.42.20, V25.4.42.21 - TC3B15C: V25.4.26.52, V25.4.26.53 - TC3T14C: V25.4.43.20 - TC3T15C: V25.4.43.21 Potentially affected scope:Tenda smart camera firmware versions using the same ZhiLing/Kylin OEM architecture, including firmware released after November 2025, unless the vendor has redesigned the underlying Kylin/ATE module. A command injection vulnerability exists in the `Kylin` binary included in Tenda smart camera firmware. In the analyzed firmware sample, the vulnerable code path is located around function address `0x926A8`, which is responsible for handling ATE-related commands. An attacker can send a crafted JSON packet to the device over UDP port `7320`. After receiving UDP data, the `CAte::HandleCmd` function directly proceeds to JSON parsing and command handling without authentication, token verification, or IP-based access control. User-controlled fields parsed from the JSON payload are formatted into system command strings through `snprintf` and are subsequently executed by the `ATE_SetCmd` function via `popen`. Because the user-controlled input is not properly validated, sanitized, or escaped before entering the command execution chain, an attacker can inject shell metacharacters and alter the intended command flow. Successful exploitation may allow an unauthenticated network attacker to execute arbitrary system commands on the affected device, potentially leading to device compromise, information disclosure, or further system manipulation. |
| 来源 | ⚠️ https:/ |
| 用户 | Howitouchyou (UID 99230) |
| 提交 | 2026-06-25 04時38分 (2 月前) |
| 管理 | 2026-08-13 16時39分 (2 months later) |
| 状态 | 已接受 |
| VulDB条目 | 389498 [Tenda CH7 直到 20260625 ATE Module Kylin CAte::HandleCmd 权限提升] |
| 积分 | 20 |