CVE-2026-51603: Tenda CP3 V3.0 RTSP Denial of Service Vulnerability

Technical summary

CVE-2026-51603 is a stack-based buffer overflow (CWE-121) in the RTSP protocol handler of Tenda CP3 V3.0 (firmware V31.1.9.91). The vulnerability exists in the second-stage URL routing parser invoked during SETUP request processing. After a client completes a legitimate RTSP handshake (OPTIONS → DESCRIBE → initial SETUP), the service maintains state via a session ID. When processing a subsequent SETUP request, the URL field parser fails to enforce length bounds, accepting a URL formed by concatenating a valid RTSP endpoint exactly four times. This bypasses first-stage format checks and causes controlled memory corruption on the stack, dereferencing the service process and triggering an immediate crash. No code execution or authentication bypass is demonstrated; impact is denial of service only.

Business impact

For organizations deploying Tenda CP3 routers as edge network devices or in consumer-facing environments, this vulnerability creates an availability risk. A single crafted RTSP request can render the device unreachable, disrupting IP camera feeds, media streams, and potentially user connectivity if the router is a network hub. Attack surface is limited to network-adjacent attackers who can send RTSP traffic (typically port 554), but establishing the attack requires no authentication—only completion of a standard RTSP session. In production environments where uptime and monitoring are critical, repeated crashes force manual intervention and represent operational friction.

Affected systems

Tenda CP3 V3.0 with firmware V31.1.9.91 is confirmed affected. Other firmware versions, Tenda CP3 model variants, and other Tenda product lines have not been evaluated in the provided information. Verify affected firmware versions and model numbers against Tenda's security advisory before assuming scope.

Exploitability

Exploitability is straightforward in contexts where an attacker has network access to port 554 (RTSP). The attack requires no special privileges or user interaction—it is fully automated. An attacker must send four ordered RTSP requests (OPTIONS, DESCRIBE, SETUP, then crafted SETUP) to a reachable device. The crafted payload is deterministic and does not depend on Address Space Layout Randomization or other runtime factors. Practical barriers include network segmentation: if RTSP is restricted to trusted VLANs or is not externally exposed, attack surface shrinks. However, in default or misconfigured deployments, the attack is trivial to execute.

Remediation

Apply a patched firmware version released by Tenda that addresses the RTSP URL validation flaw. Until a patch is available, restrict network access to port 554 (RTSP) via firewall rules, allowing only trusted IP addresses or subnets to initiate RTSP sessions. If the device is not actively used for RTSP media streaming, disable the RTSP service entirely via the router's administrative interface. Monitor device availability and restart procedures to detect repeated crashes suggestive of active exploitation.

Patch guidance

Tenda should release a firmware update that enforces strict length validation on the URL field during second-stage SETUP request parsing, regardless of first-stage format checks. Verify patch availability and version numbers on Tenda's official security advisory or support portal. Firmware updates for Tenda CP3 V3.0 are typically delivered via the router's web interface (Administration > Firmware Upgrade) or as downloadable images from the vendor's support site. Test patches in a non-production environment before rollout to production networks.

Detection guidance

Monitor for repeated RTSP SETUP requests to port 554 from the same source IP, especially sequences that include oversized URL fields or URLs containing repetitive patterns (four identical RTSP endpoints concatenated). Network-based IDS/IPS rules can identify payloads matching the known attack pattern (four consecutive valid RTSP URLs in a single SETUP request). Log and alert on unexpected crashes of RTSP service processes on Tenda CP3 devices. Baseline normal RTSP traffic and flag deviations. Endpoint agents on monitoring systems should track uptime of critical devices and trigger alerts on unscheduled restarts.

Why prioritize this

This vulnerability merits prompt attention because it enables a trivial, unauthenticated denial of service attack on an internet-accessible network service. Although impact is limited to availability (no data exfiltration or code execution), the low barrier to exploitation and high CVSS score (7.5 HIGH) reflect real operational risk. Organizations running Tenda CP3 V3.0 devices in production should prioritize patching or access controls. The lack of KEV listing indicates it has not yet been observed in active, widespread exploitation campaigns, but the straightforward nature of the attack makes weaponization likely if awareness spreads.

Risk score, explained

CVSS 7.5 (HIGH) reflects a remotely exploitable, unauthenticated denial of service with no special conditions required (AV:N, AC:L, PR:N, UI:N). Impact is confined to availability (A:H; Confidentiality and Integrity unaffected). Scope is unchanged (S:U), meaning the impact does not cross privilege boundaries. The score appropriately balances the ease and universality of exploitation against the limited scope of harm (availability only). In environments where RTSP service is critical or where device downtime carries high cost, risk may be perceived as higher; risk management should contextualize CVSS against local business requirements.

Frequently asked questions