THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-86148 (CRITICAL 9.1) — A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack re

[NVD] CVE-2026-86148 (CRITICAL 9.1) — A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack re

mednvdPublished 2026-09-05

CVE-2026-86148 CVSS: 9.1 CRITICAL Published: 2026-09-05T22:17:18.743

A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely.

Indicators of compromise

CVE-2026-86148cve
27.5.57.101ipv4

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-86148