CVE-2026-19749
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. The RTSP/ONVIF component has missing authentication, allowing remote attacks, though the attack is considered difficult.
Risk Assessment
Risk of unauthorized access to RTSP/ONVIF functionality, potentially enabling device takeover or eavesdropping.
Recommendation
Update device firmware to the latest version if available and monitor vendor advisories.
Original NVD description (English source)
A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability is an unknown functionality of the component RTSP/ONVIF. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is now public and may be used.