{"id":"CVE-2026-86151","title":"A vulnerability was detected in Tenda CP3 27.5.57.101","summary":"A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection…","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-77","CWE-78"],"vendor":"Tenda","product":"CP3","affected":["CP3 27.5.57.101"],"published":"2026-09-06","updated":"2026-09-11","sourceUpdated":"2026-09-11T21:17:33.980","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86151","references":[{"url":"https://vuldb.com/cve/CVE-2026-86151","label":"cna@vuldb.com"},{"url":"https://vuldb.com/submit/895352","label":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/399274","label":"cna@vuldb.com"},{"url":"https://vuldb.com/vuln/399274/cti","label":"cna@vuldb.com"},{"url":"https://www.tenda.com.cn/","label":"cna@vuldb.com"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-11T20:15:50.551027Z"},"epss":0.02043,"epssPercentile":0.80049,"ingestedAt":"2026-09-06T14:56:25.861Z","slug":"CVE-2026-86151","body":"## Overview\n\nA vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection. The attack may be initiated remotely.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":62,"depthScoreParts":{"impact":50.1,"likelihood":0.4,"exploitation":12,"ransomware":0},"changes":[{"seq":202076,"id":"CVE-2026-86151","ts":1789400047845,"field":"exploit_available","old":"false","new":"true"},{"seq":200803,"id":"CVE-2026-86151","ts":1789397616043,"field":"exploit_available","old":"true","new":"false"},{"seq":199496,"id":"CVE-2026-86151","ts":1789395527698,"field":"exploit_available","old":"false","new":"true"},{"seq":198741,"id":"CVE-2026-86151","ts":1789392243696,"field":"exploit_available","old":"true","new":"false"},{"seq":197074,"id":"CVE-2026-86151","ts":1789384292079,"field":"exploit_available","old":"false","new":"true"},{"seq":196383,"id":"CVE-2026-86151","ts":1789383756605,"field":"exploit_available","old":"true","new":"false"},{"seq":195828,"id":"CVE-2026-86151","ts":1789380634521,"field":"exploit_available","old":"false","new":"true"},{"seq":194203,"id":"CVE-2026-86151","ts":1789378782714,"field":"exploit_available","old":"true","new":"false"},{"seq":192990,"id":"CVE-2026-86151","ts":1789376514724,"field":"exploit_available","old":"false","new":"true"},{"seq":191777,"id":"CVE-2026-86151","ts":1789373630726,"field":"exploit_available","old":"true","new":"false"},{"seq":190562,"id":"CVE-2026-86151","ts":1789369475050,"field":"exploit_available","old":"false","new":"true"},{"seq":189349,"id":"CVE-2026-86151","ts":1789368408930,"field":"exploit_available","old":"true","new":"false"},{"seq":188132,"id":"CVE-2026-86151","ts":1789365230405,"field":"exploit_available","old":"false","new":"true"},{"seq":186919,"id":"CVE-2026-86151","ts":1789363470910,"field":"exploit_available","old":"true","new":"false"},{"seq":185705,"id":"CVE-2026-86151","ts":1789361228774,"field":"exploit_available","old":"false","new":"true"},{"seq":184492,"id":"CVE-2026-86151","ts":1789358363333,"field":"exploit_available","old":"true","new":"false"},{"seq":182743,"id":"CVE-2026-86151","ts":1789354316772,"field":"exploit_available","old":"false","new":"true"},{"seq":181536,"id":"CVE-2026-86151","ts":1789353317323,"field":"exploit_available","old":"true","new":"false"},{"seq":180329,"id":"CVE-2026-86151","ts":1789350284361,"field":"exploit_available","old":"false","new":"true"},{"seq":179122,"id":"CVE-2026-86151","ts":1789348292488,"field":"exploit_available","old":"true","new":"false"},{"seq":177915,"id":"CVE-2026-86151","ts":1789346369663,"field":"exploit_available","old":"false","new":"true"},{"seq":176708,"id":"CVE-2026-86151","ts":1789343184145,"field":"exploit_available","old":"true","new":"false"},{"seq":174825,"id":"CVE-2026-86151","ts":1789334875331,"field":"exploit_available","old":"false","new":"true"},{"seq":173620,"id":"CVE-2026-86151","ts":1789333686491,"field":"exploit_available","old":"true","new":"false"},{"seq":172434,"id":"CVE-2026-86151","ts":1789331092665,"field":"exploit_available","old":"false","new":"true"},{"seq":171248,"id":"CVE-2026-86151","ts":1789328780507,"field":"exploit_available","old":"true","new":"false"},{"seq":170043,"id":"CVE-2026-86151","ts":1789327196801,"field":"exploit_available","old":"false","new":"true"},{"seq":168838,"id":"CVE-2026-86151","ts":1789323839693,"field":"exploit_available","old":"true","new":"false"},{"seq":167633,"id":"CVE-2026-86151","ts":1789319702141,"field":"exploit_available","old":"false","new":"true"},{"seq":166428,"id":"CVE-2026-86151","ts":1789318775760,"field":"exploit_available","old":"true","new":"false"},{"seq":165223,"id":"CVE-2026-86151","ts":1789315789637,"field":"exploit_available","old":"false","new":"true"},{"seq":164018,"id":"CVE-2026-86151","ts":1789313633908,"field":"exploit_available","old":"true","new":"false"},{"seq":162813,"id":"CVE-2026-86151","ts":1789311903062,"field":"exploit_available","old":"false","new":"true"},{"seq":161608,"id":"CVE-2026-86151","ts":1789308732846,"field":"exploit_available","old":"true","new":"false"},{"seq":159721,"id":"CVE-2026-86151","ts":1789300470227,"field":"exploit_available","old":"false","new":"true"},{"seq":158833,"id":"CVE-2026-86151","ts":1789299571997,"field":"exploit_available","old":"true","new":"false"},{"seq":158290,"id":"CVE-2026-86151","ts":1789296693038,"field":"exploit_available","old":"false","new":"true"},{"seq":156710,"id":"CVE-2026-86151","ts":1789294755277,"field":"exploit_available","old":"true","new":"false"},{"seq":155505,"id":"CVE-2026-86151","ts":1789292967578,"field":"exploit_available","old":"false","new":"true"},{"seq":154300,"id":"CVE-2026-86151","ts":1789289797218,"field":"exploit_available","old":"true","new":"false"},{"seq":151551,"id":"CVE-2026-86151","ts":1789277629511,"field":"exploit_available","old":"false","new":"true"},{"seq":150512,"id":"CVE-2026-86151","ts":1789276245279,"field":"exploit_available","old":"true","new":"false"},{"seq":149479,"id":"CVE-2026-86151","ts":1789273824352,"field":"exploit_available","old":"false","new":"true"},{"seq":148446,"id":"CVE-2026-86151","ts":1789271348372,"field":"exploit_available","old":"true","new":"false"},{"seq":146477,"id":"CVE-2026-86151","ts":1789269397654,"field":"exploit_available","old":"false","new":"true"},{"seq":145282,"id":"CVE-2026-86151","ts":1789266339207,"field":"exploit_available","old":"true","new":"false"},{"seq":144186,"id":"CVE-2026-86151","ts":1789262616394,"field":"exploit_available","old":"false","new":"true"},{"seq":143090,"id":"CVE-2026-86151","ts":1789261533066,"field":"exploit_available","old":"true","new":"false"},{"seq":141921,"id":"CVE-2026-86151","ts":1789258831419,"field":"exploit_available","old":"false","new":"true"},{"seq":140762,"id":"CVE-2026-86151","ts":1789256726786,"field":"exploit_available","old":"true","new":"false"}]}