Critical severity9.1NVD Advisory· Published Sep 5, 2026

CVE-2026-86148

Description

A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely.

Affected products

Tenda/CP3llm-fuzzy
Range: 27.5.57.101

Patches

Vulnerability mechanics

References

vuldb.com/cve/CVE-2026-86148nvd
vuldb.com/submit/895348nvd
vuldb.com/vuln/399271nvd
vuldb.com/vuln/399271/ctinvd
www.tenda.com.cnnvd

News mentions

No linked articles in our index yet.

cvss	0.591
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000