by Kastro
Paper/Archive/CVE-2026-19747

CVE-2026-19747

Tenda CH7 — Tenda CH7 ATE Module Kylin HandleCmd command injection

EPSS 3%public exploitCVSS 9.8
critical.is priorityof 100
57
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 87.6.876 × 2017.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carried out remotely.

Affected

ProductAffectedFixed inSource
CH720260625–CNA
CH7G20260625–CNA
CH1020260625–CNA
CP320260625–CNA
CP3 Pro20260625–CNA
CP720260625–CNA
TC3B14C20260625–CNA
TC3B15C20260625–CNA
TC3T14C20260625–CNA
TC3T15C20260625–CNA

Scores by source

VulDB (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
VulDB (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

writeupvuldb.com/vuln/389498refvuldb.com/vuln/389498/ctiwriteupvuldb.com/cve/CVE-2026-19747writeupvuldb.com/submit/868463exploitgithub.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20Command%20Injection/Tenda%20Command%20Injection.mdreftenda.com.cn