Tenda CP3 CVE-2026-51601

Exploitation requires network reachability to the Tenda CP3 RTSP service (typically TCP/554) and completion of a standard RTSP session handshake before sending the malicious PLAY request; no credentials are needed (CVSS PR:N, unauthenticated). The specific trigger is a PLAY request carrying an over-long clock= value inside the Range header field - that oversized clock= parameter IS the concrete precondition. Limiting factors: the attacker must be able to reach the RTSP port, so cameras behind NAT/firewalls or on isolated networks are not remotely exploitable; the impact is confined to a service crash (denial of service) on the affected firmware V31.1.9.91 of hardware V3.0, with no demonstrated confidentiality or integrity effect.

The signals are internally consistent and point to a real but bounded risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects a network-reachable, low-complexity, unauthenticated attack whose only impact is availability - matching the description's 'crash' outcome rather than compromise. EPSS is low (0.19%, 9th percentile) and the vulnerability is not in CISA KEV, so there is no evidence of widespread or automated exploitation; this reads as a targeted nuisance/DoS issue, not a mass-exploitation priority. One nuance worth flagging: CWE-121 stack overflows can sometimes escalate to code execution, but the CVSS impact metrics (C:N/I:N/A:H) and the description both state only a crash, so RCE should be treated as unconfirmed unless the vendor or researcher demonstrates it. The described requirement to complete a 'standard RTSP session handshake' is a minor gating factor that AC:L already accommodates.

An attacker who can reach the camera's RTSP port (e.g., a device exposed to the internet or reachable from a compromised LAN host) completes a normal RTSP handshake and issues a PLAY request whose Range header contains a very long clock= value. The oversized value overflows a stack buffer in the RTSP parser and crashes the service, cutting off the camera's video stream; a public GitHub write-up describes the reproduction, so replication is low-effort for a network-adjacent attacker.