EUVD-2026-58472
GHSA-5m3q-6cc9-72xm
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-exploitable RTSP/ONVIF with no prior authentication; AC:H reflects described exploitation difficulty; impact confined to low confidentiality read access with no integrity or availability effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability is an unknown functionality of the component RTSP/ONVIF. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is now public and may be used.
AnalysisAI
Missing authentication on RTSP/ONVIF interfaces across ten Tenda smart camera product lines allows unauthenticated remote attackers to access live video streams without credentials. Affected devices include CH7, CH7G, CH10, CP3, CP3 Pro, CP7, and the TC3-series (TC3B14C, TC3B15C, TC3T14C, TC3T15C) running firmware through 20260625. Public proof-of-concept exploit code exists on GitHub (E:P per CVSS 4.0 supplemental metrics), though high attack complexity (AC:H) limits trivial mass exploitation; no vendor patch has been identified at time of analysis.
Technical ContextAI
RTSP (Real Time Streaming Protocol, RFC 2326) is the standard protocol for delivering IP camera video streams; ONVIF (Open Network Video Interface Forum) is the widely adopted interoperability standard for IP camera device management and discovery. CWE-306 (Missing Authentication for Critical Function) identifies the root cause: the RTSP and ONVIF service endpoints on these Tenda devices fail to enforce credential checks before granting access to video stream data or device management functions. The CPE data confirms ten distinct Tenda product families affected under the cpe:2.3:a:tenda namespace, all with wildcard version specifiers up to the 20260625 firmware cutoff. Because RTSP and ONVIF are network-facing services enabled by default on IP cameras to support remote viewing, the attack surface is present on any network-reachable device without additional firewall controls.
RemediationAI
No vendor-released patch has been identified at time of analysis; the vulnerability reporter references a public PoC document at https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20RTSP_ONVIF%20Auth%20Bypass/Tenda%20RTSP_ONVIF%20Auth%20Bypass.md but no official Tenda firmware update is confirmed. As immediate compensating controls: block inbound TCP port 554 (RTSP) and ports 80/8080 (ONVIF HTTP) at the network perimeter for all affected camera models - note this will prevent legitimate remote video viewing until a patch is available. Place cameras behind a VPN or enforce network-level access control (ACLs, firewall rules) so only trusted hosts can reach RTSP/ONVIF services; this eliminates the network-reachability prerequisite without disrupting local viewing. If the camera's administration interface permits disabling ONVIF, do so for devices not requiring ONVIF interoperability. Monitor https://www.tenda.com.cn/ for firmware updates addressing CVE-2026-19749.
Command injection in the ATE (Automatic Test Equipment) module across ten Tenda camera and hub models allows a remote un
Insufficient entropy in session token generation across ten Tenda smart camera and router models enables remote attacker
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today