CVE-2026-86148

A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely.

  • Published Sep 5, 2026
  • CVSS 9.4 critical
  • 2.9% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-86148 at the National Vulnerability Database