A critical OS command injection vulnerability in Tenda CP3 version 27.5.57.101 allows remote attackers to execute arbitrary commands on the underlying system.

This vulnerability occurs in the Net/NetCheckPing.cpp file, where insufficient validation of the interface_name or host arguments allows an attacker to inject and execute arbitrary OS commands. This can be triggered remotely.

The CVSS score of 9.1 underscores the critical impact of this vulnerability. Successful command injection allows an attacker to execute arbitrary code with system-level privileges, resulting in full control over the affected device, potential data exfiltration, and the ability to use the device as a pivot point for further network attacks.

Immediate Action: Monitor the Tenda official support portal for firmware updates and apply them as soon as they become available.

Proactive Monitoring: Monitor network traffic for suspicious command-line patterns or unexpected outbound connections from the Tenda CP3 device.

Compensating Controls: Ensure the device management interface is not exposed to the internet and utilize a WAF or firewall to block requests containing malicious command patterns if possible.

Public Exploit Available: Unknown; no confirmed public exploit or weaponized module is currently identified.

This vulnerability is highly critical and presents a significant risk of remote code execution. It is imperative to restrict access to the device management functions from untrusted networks immediately. Organizations should verify that these devices are not directly reachable from the internet while awaiting a vendor-supplied patch.