CVE-2026-51605: Tenda CP3 RTSP Stack Buffer Overflow Denial of Service

Technical summary

CVE-2026-51605 is a stack-based buffer overflow (CWE-121) in the RTSP service handler of Tenda CP3 V3.0 firmware V31.1.9.991. The vulnerability is triggered when the service processes a malformed TEARDOWN request, allowing stack memory to be overwritten. The resulting memory corruption causes immediate process termination, leading to denial of service. The attack surface is unauthenticated and network-accessible, with no special conditions required for exploitation.

Business impact

Organizations deploying Tenda CP3 devices as streaming endpoints or RTSP-enabled appliances face availability risk. A successful attack disrupts streaming services, camera feeds, or media services dependent on RTSP, potentially impacting surveillance systems, broadcast infrastructure, or content delivery workflows. The impact is primarily operational continuity rather than data confidentiality or integrity, but repeated attacks could strain incident response resources and erode service reliability.

Affected systems

Tenda CP3 devices running firmware version V31.1.9.991 are confirmed vulnerable. The Tenda CP3 V3.0 is a compact media player or streaming device; organizations should verify their deployed firmware version against this specific release. Devices running earlier or later firmware versions may be affected depending on whether the code path was present and subsequently patched—vendors should consult Tenda's advisory for the complete list of vulnerable and patched firmware releases.

Exploitability

Exploitation is straightforward: an attacker with network access to the RTSP service (typically port 554) can craft and send a malicious TEARDOWN request without authentication. No user interaction is required. The attack is deterministic and does not depend on memory layout randomization or other defensive measures, making it reliably reproducible. The lack of authentication and the low complexity of the attack vector make this a high-exploitability vulnerability for any exposed device.

Remediation

Immediate action is to verify your Tenda CP3 devices' firmware version and consult Tenda's official security advisory for a patched firmware release. Firmware updates should be staged and tested in a non-production environment before broad deployment to ensure compatibility with dependent systems. Until patching is feasible, restrict network access to the RTSP service through firewall rules, segmentation, or ACLs to limit exposure to trusted networks only. Consider disabling RTSP services if not actively used.

Patch guidance

Contact Tenda support or visit their security advisory portal for patched firmware versions addressing CVE-2026-51605. Verify patch compatibility with your device model and dependent applications before deployment. Firmware updates typically require device restart; schedule patching during maintenance windows to minimize disruption. Document the pre-update and post-update firmware versions for audit and compliance tracking.

Detection guidance

Monitor RTSP service logs for malformed TEARDOWN requests or unexpected disconnections. Network intrusion detection systems should flag oversized or anomalous RTSP TEARDOWN packets directed at port 554. Endpoint monitoring tools can alert on unexpected restarts or crashes of RTSP service processes. Implement rate limiting on RTSP control connections to mitigate repeated attack attempts. Baseline normal RTSP request sizes and flag deviations.

Why prioritize this

This vulnerability scores HIGH (CVSS 7.5) and is unauthenticated, remotely exploitable, and deterministic. Although the impact is limited to denial of service (not code execution or data breach), the ease of exploitation, lack of authentication, and direct accessibility over the network elevate urgency. Any publicly exposed Tenda CP3 device is at immediate risk. Prioritize based on deployment exposure: internet-facing devices require emergency patching; internally networked devices should be patched within your standard maintenance cycle but flagged for accelerated treatment if the RTSP service is business-critical.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects a network-accessible, unauthenticated attack with no complexity barriers and direct availability impact. The absence of confidentiality or integrity impact (both None) prevents a higher score. However, the practical ease of exploitation and the real-world risk to streaming and surveillance workflows justify treating this as a priority vulnerability in environments where Tenda CP3 devices are deployed and exposed.

Frequently asked questions