VulnSocial

CVE-2026-86148Disclosure

LOWCVSS 9.4 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-77CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 3 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 2d ago at 1 mentions (2026-09-06); latest day: 1
  • 3 total mentions across 3 days

Deep dive

Activity timeline3 mentions / 3d
00111Mentions · 2026-09-06: 1Mentions · 2026-09-07: 1Mentions · 2026-09-10: 1Patch / Workaround · 2026-09-06: 1Technical Details · 2026-09-06: 1Technical Details · 2026-09-07: 1Technical Details · 2026-09-10: 109-0609-0709-10
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-061
Disclosure1
2026-09-071
Disclosure1
2026-09-101
General1
Full discourse3 posts
  • Rıdvan Yağlı@ridvanyagli
    Disclosure

    🚨 Tenda CP3'te yeni kritik güvenlik açıkları! Tenda CP3 adlı güvenlik kamerasının 27.5.57.101 firmware sürümünde yeni güvenlik açıkları ortaya çıktı. 🔴 CVE-2026-86148 — CVSS 9.1 🔴 Uzaktan OS command injection 🔴 Saldırganın özel hazırlanmış girdilerle işletim sistemi komutları çalıştırmasına yol açabiliyor. Ayrıca CP3 için CVE-2026-86149 adlı başka bir kritik OS command injection açığı da yayınlandı. CP3 kullanıyorsanız firmware sürümünüzü kontrol etmeniz ve cihazı mümkünse doğrudan internetten erişilebilir bırakmamanız önerilir.

    Post summary

    Tenda CP3 firmware 27.5.57.101 has two critical OS command injection CVEs (2026-86148 and 2026-86149). The advisory urges firmware checks and to avoid exposing the device to the internet.

    02020628
    2.4K followersView on X
  • NotCVE@notCVE
    General

    🎯 Most likely to be exploited next (EPSS): • CVE-2026-79697 — EPSS 3.4% · CVSS 9.9 • CVE-2026-78488 — EPSS 3.2% · CVSS 6.5 • CVE-2026-86148 — EPSS 2.5% · CVSS 9.4 📄 Full weekly tables → https://github.com/notcve/reports/blob/main/weekly/2026-09-10.md

    Post summary

    The post catalogs three CVEs ranked by EPSS and CVSS, suggesting they are potential future targets, and links to a detailed weekly report.

    0000038
    70 followersView on X
  • Cybersecurity News DE@cybsecuritynews
    Disclosure

    #schwachstellen Vier kritische Tenda-Lücken erlauben Remote-Command-Injection und Buffer Overflow #boa #cp3 #cve202686148 #cve202686151 #cve202686165 #cve202686167 #hg10 #kylin #tenda https://cybersecurity-news.de/tenda-schwachstellen-cve-2026-86148-86151-86165-86167

    Post summary

    The article discloses four critical Tenda CVEs that enable remote command injection and buffer overflow vulnerabilities, but does not present PoC code, active exploitation reports, or patch information.

    0000060
    12 followersView on X

Explore more

Back to dashboard