Predictable Session Cookie in Tenda Smart Camera Allows Auth Bypass and Admin Privilege Escalation

Vulnerability Overview Title: Predictable SESSION Cookie in Tenda Smart Cameras Allows Authentication Bypass and Web Administrator Privilege Escalation Affected Versions: Tenda smart camera firmware utilizing the ZhiLingKylin OEM solution. Verified affected versions include: - CH Series: CH10: V26.4.41.36, CH7: V26.5.59.2, CH7G: V26.5.60.2 - CP Series: CP3: V22.5.4.110, V27.5.52.11, V27.5.52.17, V27.5.57.17; CP3 Pro: V21.7.17.111, CP7: V26.5.45.17 - TC3 Series: TC3B14C: V25.4.25.53, V25.4.42.20, V25.4.42.21; TC3B15C: V25.4.26.52, V25.4.26.53; TC3T14C: V25.4.43.20, TC3T15C: V25.4.43.21 Potential Scope: Firmware versions for Tenda smart cameras sharing the same ZhiLingKylin OEM architecture, including firmware released after November 2025, unless the vendor has redesigned the underlying Kylin/ATE modules. Vulnerability Type: Authentication Bypass / Predictable Session Token / Improper Session Management Vulnerability Description: A predictable session management vulnerability exists in the web management service of Tenda smart cameras based on the ZhiLingKylin OEM firmware architecture. The affected firmware uses simple integer values as Web administrator SESSION cookies. The session value is parsed directly from the field in the HTTP Cookie header. The login handler issues session tokens using the same integer format via . Due to insufficient entropy in session identifiers and the lack of effective brute-force protection, an attacker with access to the camera's web interface can enumerate or guess valid administrator sessions. Once a valid session is identified, the attacker can access authenticated Web APIs as an administrator without knowing the correct password. Successful exploitation allows the attacker to gain Web administrator privileges and manipulate sensitive camera functions, such as modifying security configurations, enabling debug interfaces, disabling RTSP authentication, disabling ONVIF authentication, or performing other administrative actions. This issue may also be chained with other vulnerabilities to further compromise the device. Vulnerability Details: At address , the function parses the cookie using an integer format, indicating that the session identifier is a simple, predictable integer rather than a cryptographically secure random token. At address , the function constructs the header using the format , proving that the session identifier is represented as a plain integer value. At address , the function compares only the first six characters during password verification, providing an incomplete password validation flaw. Outcome: The session space is small and predictable. An attacker can repeatedly send authenticated Web API requests with different integer values until the device accepts a valid administrator session. Vulnerability Utility: This vulnerability is particularly exploitable when an administrator is already logged into the camera's web interface. In this scenario, a valid active session exists on the device, and the attacker only needs to identify the correct integer value. Once the correct value is guessed, the attacker gains the same administrative privileges as the legitimate user. Weak Credential Verification Logic: The authentication logic also exhibits weak credential verification behavior by comparing only the first six bytes. Although this is a separate weakness, it further demonstrates that the affected web authentication and session management implementations are insecure. Impact Scope Affected Versions: The Tenda smart camera firmware versions listed above. Potential Impact: Attackers can obtain Web administrator privileges and manipulate sensitive camera functions, potentially leading to persistent or irreversible damage. Remediation Vendors should redesign the underlying Kylin/ATE modules to use more secure session management mechanisms, such as cryptographically secure random tokens. Enhance password verification logic to ensure complete password comparison. Implement effective brute-force protection mechanisms to prevent session enumeration. POC Code Summary This vulnerability involves a predictable SESSION Cookie in Tenda smart cameras, allowing attackers to bypass authentication and obtain Web administrator privileges. Affected versions include firmware from multiple series, with potentially severe impact. Remediation measures include redesigning the session management mechanism, enhancing password verification, and implementing brute-force protection. The POC code demonstrates how to exploit this vulnerability for session enumeration and authentication bypass.

Goal Reached Thanks to every supporter — we hit 100%!

Predictable Session Cookie in Tenda Smart Camera Allows Auth Bypass and Admin Privilege Escalation

More from this source