Tenda CP3 CVE-2026-51600

Exploitation requires only network reachability to the Tenda CP3 V3.0 RTSP service (typically TCP/554) on firmware V31.1.9.91; the CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low complexity, so no special product configuration is needed beyond the RTSP server being enabled, which it is by default on this camera. The trigger condition is specific: an RTSP request (DESCRIBE, SETUP, or PLAY) that includes a Content-Length header with no accompanying message body. The primary limiting factor is exposure rather than configuration - an attacker must be able to open TCP connections to the RTSP port, so cameras kept on isolated networks or behind a firewall that blocks RTSP are not practically reachable; impact is limited to availability (A:H) with no data disclosure or code execution.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) is internally consistent with the description: network-reachable, low-complexity, unauthenticated, availability-only impact with no confidentiality or integrity loss. SSVC reinforces this - Exploitation: poc, Automatable: yes, Technical Impact: partial - meaning the attack can be scripted and repeated cheaply, but the impact is bounded to loss of availability of one device rather than code execution or data theft. There is no EPSS score in the input and the CVE is not in CISA KEV, so widespread or active exploitation is not established; the risk is a scriptable, reliable DoS against an exposed embedded camera rather than a critical system-compromise threat. The main real-world driver of risk is exposure: CP3 cameras reachable from untrusted networks (e.g. port-forwarded RTSP) are trivially disruptable, while cameras behind a firewall on isolated VLANs face little practical risk.

An attacker who can reach the camera's RTSP port opens a TCP connection and sends an RTSP DESCRIBE (or SETUP/PLAY) request carrying a Content-Length header but no body, then repeats this in a simple loop across many connections. Because each connection is never closed and permanently holds a resource slot, the camera's RTSP service stops accepting legitimate streaming clients, taking video surveillance offline. A public proof-of-concept is referenced and SSVC marks the attack automatable, so weaponizing it into a short script is trivial.