CVE-2026-51606: Tenda CP3 RTSP Denial of Service via Oversized Field Values

Technical summary

CVE-2026-51606 is an improper input validation flaw in the RTSP (Real Time Streaming Protocol) service of Tenda CP3 V3.0 running firmware V31.1.9.91. The vulnerability stems from inadequate bounds checking on the request-line URL field and header field values across multiple RTSP request types. When an oversized field is submitted, the service abruptly closes the connection with a TCP RST packet rather than returning an RFC 2326-compliant error response (such as a 431 Request Header Fields Too Large). This non-standard behavior indicates incomplete input sanitization in the protocol handler.

Business impact

The denial-of-service condition can disrupt video surveillance and streaming operations that depend on continuous RTSP connections. For organizations relying on Tenda CP3 devices for network video monitoring, recurring connection resets create service interruptions and may trigger false alerts or missed recording windows. The vulnerability requires no authentication, making it accessible to any network-adjacent attacker, which elevates risk in shared network environments or if the device is exposed to untrusted networks.

Affected systems

Tenda CP3 V3.0 devices running firmware version V31.1.9.91 are confirmed vulnerable. The improper input handling affects the RTSP service across multiple request types, so any client application or device that communicates with the CP3 via RTSP protocol is exposed to the denial-of-service condition.

Exploitability

Exploitation requires no special privileges or user interaction. An attacker must be network-adjacent (on the same network or with network access to the device's RTSP port, typically UDP 554 or TCP 554) and send a single crafted RTSP request with an oversized field value to trigger the vulnerability. The lack of authentication requirement and the ease of crafting malformed RTSP packets make this practical to exploit with readily available tools.

Remediation

Update Tenda CP3 V3.0 devices to a patched firmware version that properly implements input validation and RFC 2326-compliant error responses. Verify the availability of a firmware update from Tenda that addresses improper input handling in the RTSP service. Until patching is possible, restrict network access to the RTSP port using firewall rules or network segmentation to limit exposure to trusted sources only.

Patch guidance

Contact Tenda support or check the Tenda product security advisories page for firmware updates addressing CVE-2026-51606. Confirm that the updated firmware properly validates field sizes and returns standards-compliant error responses instead of abruptly terminating connections. Test patches in a non-production environment before deployment to ensure compatibility with your video management system and other network components.

Detection guidance

Monitor RTSP traffic for TCP RST packets sent by Tenda CP3 devices in response to legitimate requests, as this is abnormal behavior. Log and alert on repeated connection resets from the same source IP to the RTSP port. Examine RTSP request logs for oversized field values or anomalously long header strings. Network-based intrusion detection systems (IDS) can be tuned to flag RTSP requests with field values exceeding RFC 2326 limits.

Why prioritize this

With a CVSS 3.1 score of 7.5 (HIGH), this vulnerability carries significant risk due to its ease of exploitation (no authentication, low attack complexity, network-accessible), widespread impact on availability, and potential disruption of video surveillance operations. Organizations using Tenda CP3 devices in production should treat this as a near-term priority, particularly if the devices are on network segments accessible to untrusted hosts.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a high-severity availability impact (the attacker can reliably deny service), combined with a low barrier to exploitation. The attack vector is network-based with no special privileges required (PR:N), and the attack complexity is low (AC:L). There is no impact to confidentiality or integrity, limiting the score below critical, but the ability to disrupt service at scale across multiple RTSP connections justifies the HIGH severity rating.

Frequently asked questions