Security readout for executives and security teams
Plain-English summary
Affected Tenda IP cameras may let a remote, unauthenticated attacker inject operating-system commands. Successful exploitation could expose video or device data, alter camera behavior, disrupt monitoring, or provide a foothold into connected networks. The supplied sources do not identify a vendor patch.
Executive priority
Act immediately on internet-exposed or security-critical cameras; isolate them while seeking vendor remediation. Complete an enterprise inventory promptly. Because no patch is identified in the supplied evidence, leadership should prepare for replacement where exposure cannot be safely contained.
Technical view
The reported flaw is command injection in CAte::HandleCmd within the Kylin file of the ATE Module. It affects the listed Tenda camera models through version 20260625. The supplied CVSS v2 vector rates network access, low complexity, no authentication, and complete confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most concerning where affected cameras are internet-reachable or accessible from untrusted networks. Organizations must verify model and firmware inventories because the supplied evidence does not establish whether every deployed firmware build is vulnerable or whether cloud-mediated access reaches the affected component.
Exploitation context
The supplied scoring data indicates proof-of-concept availability, and a public technical repository is referenced. However, the CVE is not listed in KEV, and the provided sources do not establish active exploitation in the wild. Treat exploitation as plausible but not confirmed operationally.
Researcher notes
The report maps to CWE-74 and CWE-77. Important unresolved details include the precise reachable interface, affected firmware range semantics, required device state, vendor confirmation, and fixed versions. Validate defensively in an authorized isolated environment without exposing production cameras or reproducing offensive payloads.
Mitigation direction
- Identify and prioritize affected Tenda models running firmware through 20260625.
- Remove direct internet exposure and restrict camera access to trusted management networks.
- Segment affected cameras from sensitive systems and limit unnecessary outbound connectivity.
- Check Tenda guidance for confirmed fixed firmware or vendor-approved remediation.
- If no fix is available, consider replacement based on exposure and business criticality.
Validation and detection
- Inventory exact camera models, firmware versions, addresses, owners, and locations.
- Verify whether management or device services are reachable from the internet or untrusted networks.
- Confirm segmentation rules prevent affected cameras from reaching sensitive internal assets.
- Review camera and network logs for unusual administrative traffic or unexpected outbound connections.
- Recheck Tenda guidance and the CVE record for remediation updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-74: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-77: Command execution behavior lookup
Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-19747 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (2.0)
- Known Exploited
- No
- Published
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
4 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR1010VulDBCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R3.95.9VulDBCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R3.95.9VulDBCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P——VulDBVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
Base CVSS 3.0 score
9.8CriticalVector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
Base CVSS 2.0 score
10CriticalVector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:POC/RL:ND/RC:UR
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineVulDB
Advisory disclosed
- Source timelineVulDB
VulDB entry created
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineVulDB
VulDB entry last update
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- VDB-389498 | Tenda CH7 ATE Module Kylin HandleCmd command injectionCVE reference, VulDB · vdb-entry, technical-description
- VDB-389498 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference, VulDB · signature, permissions-required
- CVE-2026-19747 | CVE Analysis and ReportCVE reference, VulDB · third-party-advisory
- Submit #868463 | Tenda Tenda Multiple IP Cameras Multiple Versions Command InjectionCVE reference, VulDB · third-party-advisory
- https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20Command%20Injection/Tenda%20Command%20Injection.mdCVE reference, VulDB · related
- https://www.tenda.com.cn/CVE reference, VulDB · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Neutralization of Special Elements used in a Command ('Command Injection')
Improper Neutralization of Special Elements used in a Command ('Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.