| 标题 | Tenda CP3 V3.2 V27.5.57.101 OS Command Injection |
|---|
| 描述 | A vulnerability was found in Tenda CP3 V3.2 firmware V27.5.57.101 (ChipType AX_520). The main application binary Kylin processes cloud property updates for sound/light alarm configuration (CCloudMsg Property_SoundLightAlarmConfig).
When the AlarmVoiceURL field is set, function 0x52638 builds shell commands with sprintf and executes them via the shared shell wrapper sub_2F77E8 (Apis/system.c, SystemAsh). The wrapper uses vsnprintf and runs the command with vfork and execl of /bin/ash -c (or /bin/bash if present).
The code constructs: wget -O /opt/sav/DIYAudio.aac <AlarmVoiceURL> and also runs rm on related paths via the same wrapper. If AlarmVoiceURL contains shell metacharacters, an attacker who can control this cloud property (for example via a compromised or malicious cloud-side update for a bound device) can achieve OS command injection in the Kylin process context (typically root).
Example command shape: wget -O /opt/sav/DIYAudio.aac http://example/;id;#
Identification method: reverse engineering of the official firmware with IDA Pro and Hex-Rays. Runtime exploitation on physical hardware was not completed at the time of this report.
Affected component: user-x/bin/Kylin, SHA256 bf57a1faae3160277bb298387ad870152b352fba0892457c160dca8d8e29b4d1. Related symbols/strings: AlarmVoiceURL, DIYAudio.aac, Property_SoundLightAlarmConfig, cloud_msg.cpp.
This is not a duplicate of CVE-2023-30353 or CVE-2025-5763 (legacy CP3 noodles/apollo platform) or CVE-2026-516xx (CP3 V3.0 V31.1.9.91 RTSP issues). Different product generation, firmware branch, and vulnerable code path. |
|---|
| 用户 | FengZi (UID 98139) |
|---|
| 提交 | 2026-07-19 09時12分 (2 月前) |
|---|
| 管理 | 2026-09-05 09時40分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 399271 [Tenda CP3 27.5.57.101 Kylin Apis/system.c SystemAsh AlarmVoiceURL 权限提升] |
|---|
| 积分 | 17 |
|---|