Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-19747: Tenda Router Command Injection Through Remote Access

CVE-2026-19747 · published 21 days ago

Summary

Tenda routers with certain models are vulnerable to a command injection attack when accessed remotely. This means that an attacker could potentially take control of the router and disrupt its operation or access sensitive information. Affected users should update their router's firmware to the latest version to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
tenda	ch7	20260625
tenda	ch7g	20260625
tenda	ch10	20260625
tenda	cp3	20260625
tenda	cp3 pro	20260625
tenda	cp7	20260625
tenda	tc3b14c	20260625
tenda	tc3b15c	20260625
tenda	tc3t14c	20260625
tenda	tc3t15c	20260625

Original advisory text

Tenda CH7 ATE Module Kylin HandleCmd command injection

A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carried out remotely.

References

https://vuldb.com/vuln/389498 vdb-entry technical-description
https://vuldb.com/vuln/389498/cti signature permissions-required
https://vuldb.com/cve/CVE-2026-19747 third-party-advisory
https://vuldb.com/submit/868463 third-party-advisory
https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda... related
https://www.tenda.com.cn/ product

Severity

8.9 High

CVSS 3.1: 9.8 (MITRE)

Exploitation

EPSS 2%

Type

CWE-77Command Injection

CWE-74Injection

Timeline

Published13 Aug 2026

Updated30 Aug 2026

First seen13 Aug 2026

Sources

CVE-2026-19747 · NVD

CVE-2026-19747 · MITRE

Monitor software like this

Free during beta