SEC.co
Emergency
HIGH 7.5

CVE-2026-51602: Tenda CP3 V3.0 RTSP Stack Buffer Overflow DoS Vulnerability

Tenda CP3 V3.0 devices running firmware V31.1.9.91 contain a flaw in their RTSP (Real Time Streaming Protocol) service that allows an unauthenticated attacker on the network to crash the device by sending a specially crafted request. The vulnerability exploits a gap between two validation stages: the first stage checks basic request format, but the second stage fails to properly limit the size of URL data it processes. An attacker who sends a request containing exactly four repetitions of a valid RTSP URL can overflow a buffer in memory, immediately crashing the RTSP service and making the device unavailable to all users on that network.

Source data · NVD / CISA · public domain

CVSS
3.1 · 7.5 HIGH · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses (CWE)
CWE-121
Affected products
0 configuration(s)
Published / Modified
2026-07-09 / 2026-07-10

NVD description (verbatim)

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted SETUP request. The RTSP service's second-stage URL routing parser fails to validate the length of the URL field in the first SETUP request. By supplying a URL consisting of exactly four consecutive repetitions of a valid RTSP URL, an attacker can bypass first-stage format validation and trigger a stack buffer overflow, causing an immediate crash of the RTSP service process and rendering the device inaccessible to all clients on the local network.

2 reference(s) · View on NVD →

SEC.co analysis · AI-assisted, reviewed against source

Technical summary

The RTSP service in Tenda CP3 V3.0 (firmware V31.1.9.91) contains a stack-based buffer overflow (CWE-121) in its second-stage URL routing parser. The vulnerability exists because the first-stage validation accepts requests that pass format checks, but does not enforce length constraints that the second stage expects. When a SETUP request containing precisely four concatenated valid RTSP URLs is submitted, the parser writes beyond the allocated stack buffer, corrupting the call stack and triggering an immediate process crash. No authentication is required; the attack can originate from any network-adjacent host.

Business impact

This vulnerability enables a denial-of-service attack against Tenda CP3 V3.0 devices, rendering them unavailable until manual restart. In deployments relying on these devices for streaming or network services, loss of connectivity can disrupt business operations, security monitoring, or surveillance capabilities. The attack requires no credentials and is trivial to execute, making it attractive for network disruption or as part of a multi-stage attack. Organizations using affected firmware versions face recurring availability risk if the vulnerability is not patched.

Affected systems

Tenda CP3 V3.0 devices running firmware version V31.1.9.91 are confirmed vulnerable. Other firmware versions and device models have not been explicitly confirmed in the available data; organizations should verify the applicability of patches and security updates from Tenda for their specific deployed versions and models.

Exploitability

Exploitability is high. The attack requires no authentication, no user interaction, and minimal complexity—an attacker need only craft a valid SETUP request with four repeated URL strings and send it to the RTSP service port. The flaw is reliable and repeatable, making it suitable for automated attack. The attack surface is broad: any network path to the RTSP service (typically port 554) on the local network or wider internet (if exposed) enables exploitation. No advanced techniques or special conditions are needed.

Remediation

Upgrade firmware on affected Tenda CP3 V3.0 devices to a patched version released by Tenda. The vendor should have published a firmware update addressing this buffer overflow; verify the specific patched version number against Tenda's official advisory or security bulletin. If a patch is not yet available, implement network-level mitigations: restrict RTSP service access via firewall rules to trusted hosts only, disable the RTSP service if not in use, or isolate affected devices on a segmented network to limit blast radius.

Patch guidance

Contact Tenda or visit their official support portal to obtain the latest firmware release for the CP3 V3.0 product line. Firmware updates typically address both this buffer overflow and any other known issues. Before deployment, test the patched firmware in a non-production environment to confirm compatibility and functionality. Document the current firmware version before upgrade so that rollback is possible if needed. Follow Tenda's firmware upgrade procedure carefully, ensuring stable power and network connectivity during the update.

Detection guidance

Monitor for SETUP requests sent to the RTSP service with unusually long or repeated URL field patterns. Intrusion detection systems can be configured to flag RTSP SETUP requests where the URL field contains multiple sequential repetitions of valid RTSP URLs, or where the total SETUP request size exceeds normal operational thresholds. Log all RTSP service crashes and unexpected restarts. Correlate SETUP request logs with process crash events to identify attack attempts. Network traffic analysis tools can baseline normal RTSP session patterns and alert on anomalous requests that deviate from expected client behavior.

Why prioritize this

This vulnerability merits high-priority remediation due to its ease of exploitation, lack of authentication requirement, and immediate availability impact. The CVSS 3.1 score of 7.5 (HIGH severity) reflects the attack vector (network-accessible), attack complexity (low), and impact (denial of service). While not in the CISA KEV catalog at this time, the practical risk to business continuity is substantial. Organizations operating Tenda CP3 V3.0 devices should prioritize patching or implementing network controls within the next 1–2 weeks.

Risk score, explained

The CVSS 3.1 score of 7.5 is assigned because the vulnerability meets the criteria for HIGH severity: it is remotely exploitable over the network (AV:N) without requiring special conditions or authentication (AC:L, PR:N, UI:N), it does not compromise confidentiality or integrity (C:N, I:N), but it does completely disable the availability of the RTSP service (A:H). The scope remains unchanged (S:U). The score reflects realistic risk in network environments where Tenda CP3 V3.0 devices are deployed and accessible, but does not account for organizational factors such as network segmentation, which may reduce practical risk in some deployments.

Frequently asked questions

Can this vulnerability be exploited over the Internet, or only from the local network?

The CVSS vector indicates network accessibility (AV:N), which in principle allows exploitation from any network path to the RTSP service. However, in typical deployments, RTSP services are often restricted to local network segments or behind NAT. If a Tenda CP3 V3.0 device is directly exposed to the Internet or accessible through port forwarding, it can be exploited remotely. Verify your network topology and firewall rules to determine exposure.

What happens after the RTSP service crashes? Does the device require manual intervention to recover?

The crash disables the RTSP service process, making the device unavailable for RTSP clients until the service is restarted. In some cases, the device may automatically restart the service after a delay, or an administrator may need to manually restart the device or service. This depends on the device's watchdog/restart mechanisms and operational setup. During downtime, any streaming, surveillance, or network services relying on the RTSP functionality will be unavailable.

Are there any known public exploits for this vulnerability?

As of the available data, this vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting active exploitation in the wild has not been widely reported at publication. However, the simplicity of the attack—requiring only a crafted SETUP request—means that exploitation code could be developed quickly. Do not assume safety from lack of public exploit code; prioritize patching as if exploitation is imminent.

If I cannot patch immediately, what interim steps should I take?

Implement firewall rules to restrict access to the RTSP service (typically UDP/TCP port 554) to only trusted hosts or subnets that legitimately need it. If RTSP is not actively used, disable the service entirely. Isolate affected devices on a separate network segment to limit the scope of a potential denial-of-service attack. Monitor RTSP traffic and service logs for signs of attack attempts. These measures reduce risk but do not eliminate it; patching should remain your primary remediation goal.

This analysis is provided for informational purposes to help security teams understand and mitigate the vulnerability described. It is not a substitute for official vendor advisories or professional security assessment. Patch version numbers, KEV status, and affected product lists should be verified against official Tenda security bulletins and CISA resources. Testing of patches or mitigations should be performed in non-production environments before deployment. SEC.co makes no warranty regarding the completeness or accuracy of this analysis and assumes no liability for actions taken in reliance on it. Always consult vendor documentation and follow your organization's change management and testing procedures. Source: NVD (public-domain), retrieved 2026-08-17. Analysis generated by SEC.co (claude-haiku-4-5).

Weaknesses (CWE)

CWE-121

Related vulnerabilities