CVE-2025-5763 Tenda CP3 apollo sub_F3C8C command injection
Remote attackers can execute arbitrary commands on Tenda CP3 cameras via a command injection vulnerability in the apollo component.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-5763?
CVE-2025-5763 is a medium-severity command injection vulnerability in Tenda CP3, published on 6 Jun 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability has been found in Tenda CP3 11.10.00.2311090948 and classified as critical. Affected by this vulnerability is the function sub_F3C8C of the file apollo. The manipulation leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Which versions are affected by CVE-2025-5763?
It affects 1 product.
Products include Tenda Cp3 Firmware.
How do I fix CVE-2025-5763?
No fix has been published for CVE-2025-5763 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-5763 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-5763 exists.
Other vulnerabilities in Tenda CP3
Sources
Also known as GHSA-rv56-m3gf-cgwm.