CVE-2026-51604: Tenda CP3 RTSP Stack Buffer Overflow DoS Vulnerability

Technical summary

CVE-2026-51604 is a stack-based buffer overflow (CWE-121) in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91). The vulnerability exists in the processing of PLAY requests within the RTSP protocol implementation. An attacker can craft a malicious PLAY request that overflows a stack buffer, leading to memory corruption and denial of service. The flaw is reachable over the network without authentication, making exploitation straightforward for any attacker with network access to the affected device.

Business impact

Organizations deploying Tenda CP3 devices as network cameras, streaming endpoints, or RTSP-enabled network appliances face availability risk. A denial-of-service condition causes the RTSP service to become unavailable, disrupting live streaming, surveillance feeds, or any application relying on RTSP connectivity. Recovery typically requires manual device restart. In security-critical deployments (monitoring, live event capture), service interruption can create operational gaps and impact incident response capabilities.

Affected systems

Tenda CP3 V3.0 devices running firmware version V31.1.9.91 are confirmed vulnerable. Organizations should verify their Tenda CP3 firmware version through device management interfaces. Contact Tenda support or check the Tenda security advisories to confirm whether other firmware versions or related product lines (CP2, CP4, or newer CP3 firmware revisions) are affected.

Exploitability

This vulnerability has a high exploitability index: it requires no authentication, no user interaction, and is reachable directly over the network. Any attacker with IP connectivity to an affected Tenda CP3 device can send a crafted RTSP PLAY request to trigger the buffer overflow. The attack is deterministic—no brute-forcing or race conditions required. However, exploitation currently results only in denial of service; the CVSS vector (A:H, C:N, I:N) confirms that confidentiality and integrity are not compromised, limiting the scope of direct harm.

Remediation

Firmware updates are the primary remediation. Check the Tenda support page or contact Tenda technical support to obtain and apply a patched firmware version that addresses CVE-2026-51604. Until patching is complete, network segmentation can reduce risk: restrict RTSP service access to trusted internal networks or authorized clients only, and disable RTSP if not actively in use. Monitor affected devices for unexpected restarts or service interruptions that may indicate exploitation attempts.

Patch guidance

Verify the availability of a patched firmware version from Tenda through their official security advisory or support portal. Download the firmware update only from Tenda's official website to avoid man-in-the-middle compromise. Before deploying to production, test the firmware update in a staging environment to ensure compatibility with your deployment and any integrations. Schedule a maintenance window for firmware application, as the process typically requires device reboot. Document the pre-patch firmware version and the date of update for compliance and audit purposes.

Detection guidance

Monitor network traffic for RTSP PLAY requests directed at Tenda CP3 devices, particularly any requests with unusually long or malformed payloads. Examine device logs and syslog output for RTSP service crashes or unexpected restarts, which may indicate exploitation attempts. Implement network-level detection rules for buffer overflow attempts targeting RTSP (port 554 by default), flagging payloads that exceed expected request sizes. Correlate device availability drops with inbound RTSP traffic to identify potential attacks. Consider enabling verbose logging on affected devices if available.

Why prioritize this

Despite a CVSS score of 7.5 (HIGH), this vulnerability warrants immediate attention in any environment where Tenda CP3 devices are deployed for production use. The absence of authentication barriers, combined with the ease of crafting a malicious PLAY request, makes opportunistic exploitation likely. While the impact is limited to denial of service, the simplicity of triggering it and the potential for widespread disruption across multiple devices justify rapid patching. Organizations should prioritize this above lower-exploitability vulnerabilities, especially if RTSP services are mission-critical.

Risk score, explained

CVSS 3.1 score of 7.5 reflects a HIGH-severity vulnerability driven by high network exploitability (AV:N, AC:L, PR:N, UI:N) against a vulnerability requiring no special attack complexity or user interaction. The denial-of-service impact (A:H) is significant for availability-dependent systems. The score does not reflect code execution or data compromise, which would increase severity further. Organizations should treat this as a mandatory patching priority, not an optional update.

Frequently asked questions