Critical security vulnerabilities found in Tenda CP3 router firmware

Two critical vulnerabilities, CVE-2026-86151 and CVE-2026-86150, have been identified in Tenda CP3 router firmware version 27.5.57.101. CVE-2026-86151 is an OS command injection flaw, allowing remote attackers to execute arbitrary shell commands. CVE-2026-86150 involves hard-coded credentials, potentially bypassing wireless authentication. Both remotely exploitable flaws pose significant security risks to users of affected Tenda CP3 routers, necessitating urgent attention from the vendor and users.