CVE-2026-19748CWE-330CWE-331

CVE-2026-19748

Low · published August 14, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
41.1
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected is the function CWebSessionManager_ParseSession of the file /user/bin/Kylin of the component Kylin Web Service. Such manipulation of the argument SESSION leads to insufficient entropy. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is told to be difficult.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00488 · 41.1th percentile
Weaknesses
CWE-330 · Use of Insufficiently Random Values; CWE-331 · Insufficient Entropy
Published
2026-08-14T01:17Z
References (7)
https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20Weak%20Bypass/Tenda%20Camera%20Weak%20Session%20Authentication%20Bypass.md · [email protected]https://vuldb.com/cve/CVE-2026-19748 · [email protected]https://vuldb.com/submit/868490 · [email protected]https://vuldb.com/vuln/389499 · [email protected]https://vuldb.com/vuln/389499/cti · [email protected]https://www.tenda.com.cn/ · [email protected]https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20Weak%20Bypass/Tenda%20Camera%20Weak%20Session%20Authentication%20Bypass.md · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 13 AUG 20:15Z
    Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy
    cvelistv5