Command Injection Vulnerability in Tenda Smart Camera ATE Module

A critical command injection vulnerability (CVE-2026-19747) has been identified in the ATE module of several Tenda smart camera models, including the CH7, CH7G, CH10, CP3, CP3 Pro, CP7, and various TC3-series variants. The flaw exists within the 'CAte::HandleCmd' function contained in the 'Kylin' file. By sending specially crafted requests, a remote, unauthenticated attacker can trigger this vulnerability to execute arbitrary system commands on the targeted device. Affected firmware versions include all builds up to 20260625. This vulnerability is particularly concerning due to its remote, unauthenticated nature and the high likelihood of resulting in full device compromise, potentially enabling attackers to pivot into the local network or integrate the cameras into botnets.

Attack Chain

1. Attacker performs network reconnaissance to identify accessible Tenda smart camera interfaces.
2. Attacker probes the device's web or command-handling API to target the ATE module.
3. Attacker crafts a malicious request string containing shell metacharacters intended for the 'CAte::HandleCmd' function.
4. Attacker transmits the crafted request to the camera's network port.
5. The 'Kylin' component processes the input without sufficient sanitization of the input parameters.
6. The underlying system shell interprets and executes the injected malicious commands.
7. Attacker achieves command execution with system-level privileges on the camera.
8. Attacker establishes persistent access or exfiltrates device configuration data.

Impact

Successful exploitation allows for full control of the affected smart camera, potentially enabling the use of the device for unauthorized surveillance, lateral movement within the network, or participation in distributed denial-of-service (DDoS) campaigns. Given the ubiquity of these devices in home and small office environments, the exposure of these credentials or local network access presents a significant security risk to end users.

Recommendation

• Identify and inventory all Tenda camera models listed in the affected products section within the local network.
• Restrict network access to these camera interfaces to trusted management subnets to prevent remote exploitation from the internet.
• Contact Tenda for firmware updates that address the 'CAte::HandleCmd' command injection vulnerability and apply them immediately.
• Monitor perimeter and internal network logs for abnormal HTTP or API traffic directed at Tenda devices, specifically looking for unusual shell syntax in request parameters.