Vulnerability details#

A Command Injection vulnerability has been discovered in the Tenda CP3 camera firmware (V11.10.00.2311090948), in the sub_F3C8C function of the apollo binary.

CVSS 3.0

8.8 (HIGH) CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnerable code:

sprintf(s, "echo $(cat /proc/net/rtl8188fu/wlan0/survey_info | grep '%s' | awk '{print $4}')", 
(const char *)&v31[1]);

The survey_info file contains information about the nearest Wi-Fi: Wi-Fi SSID (v31[1]) is inserted directly into the string, which is then executed. The lack of validation or escaping allows the attacker to execute arbitrary commands through the camera’s connection to Wi-Fi with the malicious SSID.

Example malicious payload: q';echo k3vg3n>/home/poc;echo '

Which would be interpreted as:

sprintf(s, "echo $(cat /proc/net/rtl8188fu/wlan0/survey_info | grep 'q';echo k3vg3n>/home/poc;echo '' | awk '{print $4}')", 
(const char *)&v31[1]);

PoC#

NOTE

The vulnerability has already been sent to the developer.

https://www.cve.org/CVERecord?id=CVE-2025-5763

Author#

@k3vg3n