What is the CVSS score of CVE-2026-51600?

CVE-2026-51600 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Tenda CP3 are affected by CVE-2026-51600?

Tenda CP3 V3.0 IP cameras (firmware V31.1.9.91) are vulnerable to remote, unauthenticated denial-of-service attacks that permanently disable streaming functionality; publicly available exploit code…

How to fix or mitigate CVE-2026-51600?

24 HOURS: Identify and document all Tenda CP3 V3.0 devices running firmware V31.1.9.91 in your asset inventory; immediately isolate these devices on a restricted VLAN with ingress/egress ACLs limiting RTSP (port 554) access to authorized management hosts only. 7 DAYS: Deploy network-based rate limiting and IDS signatures to detect malformed RTSP requests; verify monitoring system failover procedures and establish manual surveillance protocols for critical zones. 30 DAYS: Establish vendor communication plan to monitor firmware updates; develop device replacement timeline with alternative camera vendors selected for robust security update practices.

Tenda CP3 CVE-2026-51600

EUVD-2026-42643 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-09 cve@mitre.org

GHSA-chqm-m3x4-h3rh

Tenda Denial Of Service

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network attacker sends a simple malformed RTSP request with no user interaction (AV:N/AC:L/PR:N/UI:N); impact is availability-only resource exhaustion (A:H, C:N/I:N), matching the reported vector.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 19:31 vuln.today

CVSS changed

Jul 09, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Jul 09, 2026 - 17:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP requests (including DESCRIBE, SETUP, and PLAY methods). When a request carrying a Content-Length header is received without a corresponding message body, the RTSP parser enters a persistent body-awaiting state, causing the affected TCP connection to become permanently non-functional. The device does not actively close the connection, resulting in a TCP resource leak. This issue can be exploited by an unauthenticated remote attacker to cause a denial-of-service condition.

AnalysisAI

Denial of service in the Tenda CP3 V3.0 IP camera (firmware V31.1.9.91) lets an unauthenticated remote attacker exhaust TCP connection resources by sending RTSP requests (DESCRIBE, SETUP, PLAY) that advertise a Content-Length header but omit the message body, wedging the RTSP parser into a permanent body-awaiting state and leaking the connection. Repeated requests permanently disable the camera's streaming service. SSVC records a public proof-of-concept and rates the attack automatable; publicly available exploit code exists (POC), though it is not listed in CISA KEV, so there is no confirmation of active exploitation.

Technical ContextAI

The affected component is the RTSP (Real Time Streaming Protocol, RFC 2326) server embedded in the Tenda CP3 network camera, used to negotiate and deliver live video streams over TCP. RTSP borrows HTTP-style message framing, where a Content-Length header declares the size of an optional message body. The flaw is classic CWE-400 (Uncontrolled Resource Consumption): the parser trusts the declared Content-Length and blocks waiting for body bytes that never arrive, but implements no read timeout and never tears down the idle connection. Each such half-open session permanently consumes a slot in the device's limited TCP/connection table, so an attacker can starve the service of resources without ever sending a valid stream request.

RemediationAI

No vendor-released patch identified at time of analysis - no fixed firmware version or Tenda advisory appears in the input, so remediation must rely on compensating controls. The most effective control is network isolation: place CP3 cameras on a dedicated management VLAN and block inbound RTSP (TCP port 554, and any custom RTSP port the device uses) from untrusted networks and the internet, removing any port-forwarding rules that expose the camera's RTSP service externally; the trade-off is that remote live-view then requires a VPN or vendor cloud relay rather than direct RTSP access. Restrict RTSP access to known monitoring/NVR hosts via firewall allow-lists, and place a reverse proxy or session-aware firewall in front that enforces idle-connection timeouts to reap the half-open sessions the device itself will not close. Monitor for connection-table exhaustion and be prepared to power-cycle the camera to recover a wedged RTSP service. Track the referenced research report (https://github.com/kkkk2222874/cve_ID_report) and Tenda's support channel for a firmware update and apply it once released.