CVE-2023-23080

Certain Tenda products are vulnerable to command injection. This affects Tenda CP7 Tenda CP7<=V11...

9.8 Critical

Certain Tenda products are vulnerable to command injection. This affects Tenda CP7 Tenda CP7<=V11.10.00.2211041403 and Tenda CP3 v.10 Tenda CP3 v.10<=V20220906024_2025 and Tenda IT7-PCS Tenda IT7-PCS<=V2209020914 and Tenda IT7-LCS Tenda IT7-LCS<=V2209020914 and Tenda IT7-PRS Tenda IT7-PRS<=V2209020908.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.46%Up 1.5 points since Feb 28, 2023

What each source reports

NVD Score used 9.8

Record: CVE-2023-23080
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-77
Updated: 2026-11-02

CVE List No score

Record: CVE-2023-23080
Updated: 2026-11-02

EUVDEUVD-2023-27180 0.0

Record: EUVD-2023-27180
CVSS: 0.0 NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-36v3-rxv6-r759 9.8

Certain Tenda products are vulnerable to command injection. This affects Tenda CP7 Tenda CP7<=V11...

Record: GHSA-36v3-rxv6-r759
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-77
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-23080 is a critical vulnerability (CVSS 9.8) in Tenda Cp3 Firmware, published February 27, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.46%, the 84th percentile. No source names a fixed version.