CRITICAL 9.4 NVD
CVE-2026-86148
A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin
A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely.
References
- https://vuldb.com/cve/CVE-2026-86148
- https://vuldb.com/submit/895348
- https://vuldb.com/vuln/399271
- https://vuldb.com/vuln/399271/cti
- https://www.tenda.com.cn/
This critical severity vulnerability with a CVSS score of 9.4 was published on 2026-09-05 via NVD.
Risk Timeline
CVE Disclosed2026-09-05 · 0 days ago
Remediation Resources
Official Advisory
vuldb.com/cve/CVE-2026-86148Official Advisory
vuldb.com/vuln/399271Analysis & PoC
vuldb.com/submit/895348Analysis & PoC
www.tenda.com.cn/
vulnfeed aggregates 10228 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.