CVE-2026-51600: Tenda CP3 RTSP Parser Denial of Service Vulnerability

Technical summary

The vulnerability exists in the RTSP (Real Time Streaming Protocol) parser within Tenda CP3 V3.0 firmware V31.1.9.91. The parser fails to validate the Content-Length header field across multiple RTSP methods (DESCRIBE, SETUP, PLAY). When a Content-Length value is present but no corresponding message body is sent, the parser transitions to a persistent body-awaiting state and does not timeout or actively close the connection. This creates a TCP resource leak where each malformed request consumes one connection slot. The device lacks proper bounds enforcement and connection lifecycle management at the protocol level, leading to cumulative denial of service as connections accumulate.

Business impact

Organizations deploying Tenda CP3 V3.0 devices as media streaming endpoints or surveillance infrastructure face potential service disruption. An unauthenticated attacker can remotely exhaust the device's connection pool, rendering it unable to accept new sessions. This impacts availability of streaming services, surveillance feeds, or other RTSP-dependent functions. The attack requires no special privileges, credentials, or user interaction, making it a practical threat in network segments where these devices are exposed. Recovery typically requires device restart, increasing operational overhead.

Affected systems

Tenda CP3 V3.0 devices running firmware version V31.1.9.91 are confirmed affected. The vulnerability is inherent to the RTSP parser implementation in this firmware version. Other firmware versions and product variants may be affected; consult Tenda's advisory for the complete scope. Organizations should verify their device model and firmware version in the device management interface or via CLI.

Exploitability

Exploitation is straightforward and requires only network access to the RTSP service port (typically UDP 554 or TCP 554). No authentication is required. An attacker can craft malformed RTSP requests using standard tools or custom scripts, sending multiple requests to exhaust available connections. The attack is reliable and does not depend on timing, user interaction, or environmental factors. Public RTSP client tools can be repurposed for this attack, lowering the barrier to exploitation. No exploit code publication has been identified as of now, but the attack surface is easily discoverable through network reconnaissance.

Remediation

Apply the vendor's patched firmware version when available—verify the exact version number against Tenda's official security advisory. If a patch is not yet available, implement network-level mitigations: restrict RTSP access to trusted IP ranges using firewall rules, disable RTSP if not required, or place the device behind a reverse proxy that validates and enforces protocol compliance. Monitor for connection pool exhaustion and configure automated alerts if connection count exceeds normal operating levels. Consider isolating affected devices to a separate management VLAN until patched.

Patch guidance

Monitor Tenda's official support and security advisory channels for firmware updates addressing CVE-2026-51600. Firmware updates are typically applied through the device's web interface or CLI. Before patching, back up device configuration. Test patches in a non-production environment if possible. Schedule patching during maintenance windows to avoid disruption of active streaming sessions. After applying a patch, verify that RTSP functionality is restored and conduct a test of connection handling with malformed requests to confirm the issue is resolved.

Detection guidance

Monitor RTSP traffic for Content-Length headers that are not followed by corresponding message bodies. Log or alert on rapid or repeated connection establishment and termination patterns on the RTSP port. Track the device's active connection count over time; a sudden sustained increase may indicate an active attack. Enable verbose logging on the device if available and examine for parser errors or timeout warnings. Network-based detection can identify malformed RTSP packets using IDS/IPS rules that check for protocol violations. Establish a baseline of normal connection behavior and deviation analysis to detect exploitation attempts.

Why prioritize this

With a CVSS score of 7.5 (HIGH), this vulnerability merits prompt remediation. The combination of unauthenticated remote access, no user interaction required, and direct impact on availability makes it an attractive target for attackers seeking to disrupt services. While not currently listed in CISA's Known Exploited Vulnerabilities catalog, the simplicity of exploitation means weaponization is probable if the vulnerability becomes widely known. Prioritize patching devices in production or internet-facing environments, then address internal or less critical deployments.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects HIGH severity due to: (1) Network attack vector requiring no special access; (2) Low attack complexity with standard tools; (3) No privilege or user interaction required; (4) High availability impact as the device becomes unresponsive. The score does not account for confidentiality or integrity, as the vulnerability does not leak data or modify systems. Organizations with RTSP services exposed to untrusted networks should treat this as a critical operational security concern, even within the HIGH category.

Frequently asked questions