Tenda Smart Cameras CVE-2026-19749

The camera must be reachable over the network with RTSP (TCP/554) or ONVIF (HTTP) services active, which is the default operational configuration of IP cameras intended for remote viewing. No prior authentication or account is required (PR:N per CVSS 4.0). However, exploitation is rated AC:H and described as 'difficult,' implying a specific non-trivial condition must be met - likely a particular request structure, protocol sequence, or firmware state documented in the public PoC but not fully detailed in the CVE description. The impact is limited strictly to confidentiality (read access to video streams; VC:L); there is no write, delete, or denial-of-service vector confirmed by this vulnerability. Exploitation is limited to the camera's own video data - no lateral movement or scope change is indicated.

The CVSS 4.0 score of 2.9 (Low) is driven primarily by AC:H (high attack complexity), which the description corroborates - stating exploitation 'appears to be difficult' and requiring specific conditions beyond simple network connectivity. Impact is bounded to low confidentiality (VC:L) with no integrity or availability impact, meaning an attacker gains read access to video streams but cannot manipulate or disable the device via this vector. The vulnerability is NOT listed in CISA KEV, so mass or confirmed active exploitation is not established. A public PoC is confirmed on GitHub (referenced directly in the intelligence), which meaningfully lowers the exploitation barrier despite AC:H. EPSS data was not provided - this is a gap in the risk picture. The combination of a public PoC, network accessibility (AV:N), and no authentication requirement (PR:N) elevates practical risk above what the raw score suggests for internet-exposed cameras, particularly given that Tenda cameras are frequently deployed with RTSP ports open for remote viewing. However, no vendor advisory or patch has been published, and the high complexity rating is consistent with the description's characterization of non-trivial exploitation.

An attacker discovers an internet-exposed Tenda camera via an IoT search engine such as Shodan by querying for RTSP banners or ONVIF WS-Discovery responses. Using the public PoC documented on GitHub, the attacker crafts a specific unauthenticated RTSP or ONVIF request that bypasses the missing authentication gate - meeting the high-complexity condition required - and receives the live camera video stream in return. The result is unauthorized passive surveillance of the camera's field of view without any credential or foothold on the target network.