CVE-2026-19748

A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManager_ParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument SESSION leads to insufficient entropy. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is told to be difficult.

CVSS v3 3.7 LOW
CVSS v2.0 2.6 LOW

3.7^/10

CVSS v3 : LOW

Vector :

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:P/I:N/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20Weak%20Bypass/Tenda%20Camera%20Weak%20Session%20Authentication%20Bypass.md
https://vuldb.com/cve/CVE-2026-19748
https://vuldb.com/submit/868490
https://vuldb.com/vuln/389499
https://vuldb.com/vuln/389499/cti
https://www.tenda.com.cn/
https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20Weak%20Bypass/Tenda%20Camera%20Weak%20Session%20Authentication%20Bypass.md

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-13 21:17

Updated : 2026-08-14 19:09

NVD link : CVE-2026-19748

Mitre link : CVE-2026-19748

CVE.ORG link : CVE-2026-19748

JSON object : View

Products Affected

No product.

CWE

CWE-330

Use of Insufficiently Random Values

CWE-331

Insufficient Entropy

{"id": "CVE-2026-19748", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19748", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-14T16:43:42.535144Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:h:tenda:ch7:*:*:*:*:*:*:*:*"], "vendor": "Tenda", "modules": ["Kylin Web Service"], "product": "CH7", "versions": [{"status": "affected", "version": "20260625"}]}, {"cpes": ["cpe:2.3:h:tenda:ch7g:*:*:*:*:*:*:*:*"], "vendor": "Tenda", "modules": ["Kylin Web Service"], "product": "CH7G", "versions": [{"status": "affected", "version": "20260625"}]}, {"cpes": ["cpe:2.3:h:tenda:ch10:*:*:*:*:*:*:*:*"], "vendor": "Tenda", "modules": ["Kylin Web Service"], "product": "CH10", "versions": [{"status": "affected", "version": "20260625"}]}, {"cpes": ["cpe:2.3:h:tenda:cp3:*:*:*:*:*:*:*:*"], "vendor": "Tenda", "modules": ["Kylin Web Service"], "product": "CP3", "versions": [{"status": "affected", "version": "20260625"}]}, {"cpes": ["cpe:2.3:h:tenda:cp3_pro:*:*:*:*:*:*:*:*"], "vendor": "Tenda", "modules": ["Kylin Web Service"], "product": "CP3 Pro", "versions": [{"status": "affected", "version": "20260625"}]}, {"cpes": ["cpe:2.3:h:tenda:cp7:*:*:*:*:*:*:*:*"], "vendor": "Tenda", "modules": ["Kylin Web Service"], "product": "CP7", "versions": [{"status": "affected", "version": "20260625"}]}, {"cpes": ["cpe:2.3:h:tenda:tc3b14c:*:*:*:*:*:*:*:*"], "vendor": "Tenda", "modules": ["Kylin Web Service"], "product": "TC3B14C", "versions": [{"status": "affected", "version": "20260625"}]}, {"cpes": ["cpe:2.3:h:tenda:tc3b15c:*:*:*:*:*:*:*:*"], "vendor": "Tenda", "modules": ["Kylin Web Service"], "product": "TC3B15C", "versions": [{"status": "affected", "version": "20260625"}]}, {"cpes": ["cpe:2.3:h:tenda:tc3t14c:*:*:*:*:*:*:*:*"], "vendor": "Tenda", "modules": ["Kylin Web Service"], "product": "TC3T14C", "versions": [{"status": "affected", "version": "20260625"}]}, {"cpes": ["cpe:2.3:h:tenda:tc3t15c:*:*:*:*:*:*:*:*"], "vendor": "Tenda", "modules": ["Kylin Web Service"], "product": "TC3T15C", "versions": [{"status": "affected", "version": "20260625"}]}]}], "published": "2026-08-13T21:17:46.343", "references": [{"url": "https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20Weak%20Bypass/Tenda%20Camera%20Weak%20Session%20Authentication%20Bypass.md", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-19748", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/868490", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/389499", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/389499/cti", "source": "cna@vuldb.com"}, {"url": "https://www.tenda.com.cn/", "source": "cna@vuldb.com"}, {"url": "https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20Weak%20Bypass/Tenda%20Camera%20Weak%20Session%20Authentication%20Bypass.md", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-330"}, {"lang": "en", "value": "CWE-331"}]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManager_ParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument SESSION leads to insufficient entropy. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is told to be difficult."}], "lastModified": "2026-08-14T19:09:39.140", "sourceIdentifier": "cna@vuldb.com"}