CVE-2026-51604
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted PLAY request.
Risk Assessment
An attacker can remotely disable the camera, leading to loss of surveillance and potential physical security gaps.
Recommendation
Immediately update the Tenda CP3 camera firmware to the latest version if available, or restrict access to the RTSP service to trusted networks only.
Other vulnerabilities in Tenda CP3
See all- CVE-2026-51606High
An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes the device to abruptly terminate the TCP connection with a RST packet when a request containing an oversized field value is received, without returning any RFC 2326-compliant error response. This behavior affects the request-line URL field and header field values across multiple RTSP request types.
- CVE-2026-51605High
A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.991) allows an unauthenticated remote attacker to cause a denial of service via a crafted TEARDOWN request.
- CVE-2026-51603High
A stack-based buffer overflow vulnerability exists in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91). An unauthenticated remote attacker can cause a denial of service by sending a crafted second SETUP request, crashing the RTSP service.
- CVE-2026-51602High
A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted SETUP request. The second-stage URL parser fails to validate the URL length, enabling an attacker to bypass first-stage validation and trigger a stack buffer overflow, causing an immediate crash of the RTSP service and making the device inaccessible to all clients on the local network.
- CVE-2026-51601High
Tenda CP3 V3.0 firmware V31.1.9.91 contains a stack-based buffer overflow in the RTSP service. The device fails to validate the length of the clock= value in the Range header field when processing a PLAY request, which can cause the service to crash.
- CVE-2026-51600High
Tenda CP3 V3.0 firmware V31.1.9.91 fails to validate the Content-Length header in RTSP requests (DESCRIBE, SETUP, PLAY). When a request includes this header without a body, the RTSP parser enters a persistent body-awaiting state, permanently blocking the TCP connection. An unauthenticated remote attacker can exploit this to exhaust TCP resources and cause a denial-of-service condition.
Original NVD description (English source)
A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted PLAY request.