CVE-2026-51606
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes the device to abruptly terminate the TCP connection with a RST packet when a request containing an oversized field value is received, without returning any RFC 2326-compliant error response. This behavior affects the request-line URL field and header field values across multiple RTSP request types.
Risk Assessment
An attacker can exploit this vulnerability to disrupt RTSP sessions, leading to denial of service (DoS) for video surveillance or other functions relying on this protocol. The lack of proper error responses complicates diagnostics and may destabilize device operation.
Recommendation
Update the Tenda CP3 firmware to the latest version if a patch is available. Until then, restrict RTSP service access to trusted networks and filter traffic at the firewall.
Other vulnerabilities in Tenda CP3
See all- CVE-2026-51605High
A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.991) allows an unauthenticated remote attacker to cause a denial of service via a crafted TEARDOWN request.
- CVE-2026-51604High
A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted PLAY request.
- CVE-2026-51603High
A stack-based buffer overflow vulnerability exists in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91). An unauthenticated remote attacker can cause a denial of service by sending a crafted second SETUP request, crashing the RTSP service.
- CVE-2026-51602High
A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted SETUP request. The second-stage URL parser fails to validate the URL length, enabling an attacker to bypass first-stage validation and trigger a stack buffer overflow, causing an immediate crash of the RTSP service and making the device inaccessible to all clients on the local network.
- CVE-2026-51601High
Tenda CP3 V3.0 firmware V31.1.9.91 contains a stack-based buffer overflow in the RTSP service. The device fails to validate the length of the clock= value in the Range header field when processing a PLAY request, which can cause the service to crash.
- CVE-2026-51600High
Tenda CP3 V3.0 firmware V31.1.9.91 fails to validate the Content-Length header in RTSP requests (DESCRIBE, SETUP, PLAY). When a request includes this header without a body, the RTSP parser enters a persistent body-awaiting state, permanently blocking the TCP connection. An unauthenticated remote attacker can exploit this to exhaust TCP resources and cause a denial-of-service condition.
Original NVD description (English source)
An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes the device to abruptly terminate the TCP connection with a RST packet when a request containing an oversized field value is received, without returning any RFC 2326-compliant error response. This behavior affects the request-line URL field and header field values across multiple RTSP request types.