CVE-2026-86149 Tenda CP3 NetCheckPing.cpp os command injection
Remote attackers can execute arbitrary OS commands on Tenda CP3 cameras via the NetCheckPing interface, requiring immediate attention from device owners.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86149?
CVE-2026-86149 is a critical command injection vulnerability in Tenda CP3, published on 5 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the argument interface_name/host causes os command injection. The attack can be initiated remotely.
Which versions are affected by CVE-2026-86149?
How do I fix CVE-2026-86149?
No fix has been published for CVE-2026-86149 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-86149 being exploited?
There is no known exploitation of CVE-2026-86149 in the wild and no public exploit code.
Sources
Also known as GHSA-qh73-x3c2-xph4.