Tenda CP3 vulnerabilities

9 CVEs affecting Tenda CP3, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-86153, published 2026-09-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-19747, published 2026-08-13. Critical severity, CVSS 9.8. EPSS: 3.1% chance of exploitation in the next 30 days. A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the…
CVE-2026-86151, published 2026-09-06. Critical severity, CVSS 9.1. EPSS: 2.9% chance of exploitation in the next 30 days. A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a…
CVE-2026-86149, published 2026-09-05. Critical severity, CVSS 9.1. EPSS: 2.9% chance of exploitation in the next 30 days. A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the argument interface_name/host causes os…
CVE-2026-86148, published 2026-09-05. Critical severity, CVSS 9.1. EPSS: 2.9% chance of exploitation in the next 30 days. A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument…
CVE-2026-86152, published 2026-09-06. Critical severity, CVSS 10.0. EPSS: 2.9% chance of exploitation in the next 30 days. A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of the component Kylin. Executing a manipulation…
CVE-2026-86153, published 2026-09-06. Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability has been found in Tenda CP3 27.5.57.101. This affects the function CRedirServer::SetRedirectEnable of the file Functions/Redirect.cpp. The manipulation leads to improper privilege…
CVE-2026-19749, published 2026-08-13. Low severity, CVSS 3.7. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability is an unknown functionality of the…
CVE-2026-19748, published 2026-08-13. Low severity, CVSS 3.7. EPSS: 0.5% chance of exploitation in the next 30 days. A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManager_ParseSession…
CVE-2026-86150, published 2026-09-05. Medium severity, CVSS 4.1. EPSS: 0.4% chance of exploitation in the next 30 days. A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpa_passphrase leads to…