CVE-2026-51601: Tenda CP3 V3.0 RTSP Buffer Overflow Denial of Service

Technical summary

The vulnerability is a stack-based buffer overflow (CWE-121) in the RTSP service of Tenda CP3 V3.0 firmware V31.1.9.91. The flaw exists in the processing of PLAY requests, specifically in the handling of the clock= parameter within the Range header field. The device fails to validate the length of the clock= value before writing it to the stack, allowing an unauthenticated remote attacker to overflow the buffer and crash the RTSP service process. Exploitation requires completing a standard RTSP session handshake, but does not require authentication credentials or user interaction.

Business impact

Organizations deploying Tenda CP3 V3.0 devices—typically in IP camera or video surveillance deployments—face service disruption to their RTSP streaming capabilities. While the vulnerability does not enable unauthorized access to data or system compromise, it allows an attacker to render the streaming service unavailable. For environments reliant on continuous video surveillance monitoring or streaming, this denial of service can disrupt operational visibility and security monitoring functions.

Affected systems

The vulnerability affects Tenda CP3 V3.0 devices running firmware version V31.1.9.91. Organizations should inventory their Tenda CP3 deployments and verify the firmware version. Devices running other firmware versions or Tenda products other than CP3 V3.0 should be evaluated separately against vendor guidance.

Exploitability

The vulnerability is practically exploitable by unauthenticated remote attackers on the network. The RTSP service is typically accessible over the network without authentication, and the attacker only needs to complete a standard RTSP session setup before sending the malicious PLAY request. No special tools, zero-click exploitation, or complex conditions are required beyond network access to the RTSP port. The attack is deterministic and likely to be reliably weaponized once technical details are public.

Remediation

The primary mitigation is to upgrade firmware on affected Tenda CP3 V3.0 devices to a patched version released by Tenda. Verify against Tenda's official security advisory for the exact patched firmware version and deployment instructions. Until patches can be applied, restrict network access to the RTSP service using firewall rules, network segmentation, or access control lists to limit which systems can reach the RTSP port on the affected devices.

Patch guidance

Contact Tenda support or consult their official security advisory to identify the patched firmware version for Tenda CP3 V3.0. Once the patched firmware is obtained, follow Tenda's documented firmware upgrade procedure for CP3 devices. Test the upgrade in a non-production environment first to ensure compatibility with your surveillance workflow. Verify that the RTSP service functions correctly after upgrade before deploying to production.

Detection guidance

Monitor RTSP service logs on affected Tenda CP3 devices for abnormal PLAY requests containing unusually long values in the Range header's clock= parameter. Watch for repeated RTSP service crashes or restarts that correlate with network traffic to the RTSP port. Network-based detection can identify suspicious RTSP PLAY requests with oversized header values. Implement alerting on RTSP service failures and review crash logs for stack overflow indicators.

Why prioritize this

Despite a CVSS score of 7.5 (HIGH), this vulnerability should be prioritized because it affects a commonly deployed device type (IP cameras/surveillance), requires no authentication, and is trivially exploitable by remote attackers. The lack of information disclosure or integrity impact is offset by the direct impact on operational availability of security monitoring systems. The vulnerability is not currently in the CISA Known Exploited Vulnerabilities catalog, but the low barrier to exploitation means it is likely to be targeted once technical details circulate.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a HIGH severity vulnerability with network-based attack vector (AV:N), low attack complexity (AC:L), no privilege requirements (PR:N), and no user interaction (UI:N). The impact scope is unchanged (S:U), with no confidentiality or integrity impact (C:N/I:N), but high availability impact (A:H). The HIGH severity and exploitability of a denial-of-service attack on network-facing surveillance infrastructure justifies prioritization for patching, especially in security-critical environments.

Frequently asked questions