CP3 vulnerabilities
CVEs whose affected-version data names the CP3 package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
6 CVEsRSS
CVE-2026-86153Critical· 9.1A vulnerability has been found in Tenda CP3 27.5.57.101
A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege management. Remote exploitation of the at…
CVE-2026-86152Critical· 10.0A flaw has been found in Tenda CP3 27.5.57.101
A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation can lead to os command injection. The at…
CVE-2026-86151Critical· 9.1PoCA vulnerability was detected in Tenda CP3 27.5.57.101
A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection…
CVE-2026-86150Medium· 4.1A security vulnerability has been detected in Tenda CP3 27.5.57.101
A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpa_passphrase leads to hard-coded credentials. The attack can be…
CVE-2026-86149Critical· 9.1A weakness has been identified in Tenda CP3 27.5.57.101
A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the argument interface_name/host causes os command injection. The attack can be in…
CVE-2026-86148Critical· 9.1A security flaw has been discovered in Tenda CP3 27.5.57.101
A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command inject…