Tenda CP3 OS Command Injection via CAutoAddWifi::ThreadProc

Technical Analysis

The vulnerability resides in Functions/AutoAddWifi.cpp within the CAutoAddWifi::ThreadProc function of the Kylin component in Tenda CP3 devices, where insufficient input sanitization on network-supplied parameters (likely Wi-Fi SSID or configuration fields) allows injection of shell metacharacters into a system() or exec()-style call. This results in unauthenticated, remotely exploitable OS command injection, granting an attacker code execution with the privileges of the affected process—typically root on embedded Linux-based firmware. Given the CVSS 10.0 rating, no authentication or user interaction is required, making this trivially wormable across exposed devices. Organizations should assume any Tenda CP3 unit reachable from untrusted networks is at immediate risk of full compromise, including use as a pivot point into internal networks. For AI agent systems, compromised Tenda CP3 devices deployed as network cameras or IoT gateways in offices running agentic automation or RAG pipelines could serve as a foothold for lateral movement, credential harvesting (including API keys used by agents), or traffic interception, indirectly threatening the confidentiality and integrity of agent-integrated environments.

Affected Systems

Tenda CP3 firmware version 27.5.57.101; specifically the Kylin component's AutoAddWifi.cpp module handling automatic Wi-Fi provisioning/configuration.

Indicators of Compromise

• No public IOCs available at this time (indicators pending; monitor Tenda CP3 devices with unusual outbound shell command execution or unexpected process spawning from network configuration daemons)

Remediation Steps

1. 1

   Apply Vendor Patch

   Check Tenda's official support channels for a firmware update addressing this vulnerability and apply it immediately once available.

2. 2

   Restrict Network Exposure

   Ensure Tenda CP3 devices are not directly accessible from the public internet; place them behind a firewall or VPN and restrict management interfaces to trusted internal networks.

3. 3

   Network Segmentation

   Isolate IoT/camera devices like Tenda CP3 on a separate VLAN from critical infrastructure, servers, or systems running AI agent workloads to limit lateral movement in case of compromise.

4. 4

   Monitor for Exploitation

   Deploy IDS/IPS signatures for anomalous command injection patterns targeting Tenda devices and monitor logs for unexpected process execution or configuration changes.

5. 5

   Disable Unused Features

   If automatic Wi-Fi provisioning (AutoAddWifi) functionality is not required, disable it to reduce the attack surface.