What is the CVSS score of CVE-2026-51601?

CVE-2026-51601 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Tenda CP3 are affected by CVE-2026-51601?

Tenda CP3 V3.0 IP cameras (firmware V31.1.9.91) are vulnerable to unauthenticated remote denial-of-service attacks that disable video streaming capabilities.

How to fix or mitigate CVE-2026-51601?

Within 24 hours: Identify and inventory all Tenda CP3 V3.0 devices running firmware V31.1.9.91. Within 7 days: Implement firewall rules restricting RTSP access (port 554) to authorized management networks only; segment IP cameras to isolated networks; disable RTSP protocol if alternative surveillance methods are available. Within 30 days: Monitor Tenda vendor advisories for firmware updates; develop camera replacement strategy if patches remain unavailable; enable network-based detection for malformed RTSP PLAY requests with oversized Range headers.

Tenda CP3 CVE-2026-51601

EUVD-2026-42644 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-09 cve@mitre.org

GHSA-pgqw-x8wr-7q7m

Buffer Overflow Tenda Stack Overflow

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable, unauthenticated (PR:N) RTSP request of low complexity; impact limited to a service crash, so C:N/I:N and A:H only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 18:29 vuln.today

CVSS changed

Jul 10, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Jul 09, 2026 - 17:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Tenda CP3 V3.0 firmware V31.1.9.91 contains a stack-based buffer overflow in the RTSP service. The device fails to validate the length of the clock= value in the Range header field when processing a PLAY request. An unauthenticated remote attacker who has completed a standard RTSP session handshake can send a PLAY request with an excessively long clock= value to cause the RTSP service to crash.

AnalysisAI

Denial of service in the Tenda CP3 V3.0 IP camera (firmware V31.1.9.91) lets an unauthenticated remote attacker crash the onboard RTSP service by sending a PLAY request whose Range header carries an over-long clock= value, triggering a stack-based buffer overflow (CWE-121). The flaw affects only availability - a successful attack knocks the camera's video streaming offline until it recovers or is restarted, with no confirmed path to code execution or data disclosure. There is a public research write-up on GitHub, but no active exploitation is recorded in CISA KEV and EPSS rates exploitation likelihood as low (0.19%, 9th percentile).

Technical ContextAI

The affected component is the camera's embedded RTSP (Real Time Streaming Protocol) server, the standard control channel used by IP cameras to negotiate and deliver video streams. RTSP PLAY requests may include a Range header specifying playback position, and this device supports the clock= parameter to express an absolute time range. Per CWE-121 (stack-based buffer overflow), the service copies the attacker-supplied clock= string into a fixed-size stack buffer without validating its length, so an excessively long value overruns the buffer and corrupts the stack, crashing the service. EUVD lists affected versions as 'n/a', so the exact-product identity rests on the description: Tenda CP3 hardware V3.0 running firmware V31.1.9.91; no CPE string was provided in the input to further pin down configurations.

RemediationAI

No vendor-released patch is identified at time of analysis - the only references are the NVD entry and a GitHub research report, with no Tenda firmware fix version cited, so an exact upgrade target cannot be given. As compensating controls, restrict network reachability of the camera's RTSP service (typically TCP port 554) by placing cameras on an isolated VLAN or management network and blocking inbound RTSP from untrusted segments and the internet; this prevents remote triggering but will break any legitimate remote/off-network streaming or NVR integrations that traverse those boundaries. Where RTSP must remain reachable, front it with a firewall or reverse proxy that enforces source IP allowlists, and monitor the service for repeated crashes/restarts as an indicator of exploitation attempts. Check the vendor site (tendacn.com) for updated CP3 V3.0 firmware superseding V31.1.9.91 and apply it once available; until then, treat a crashed RTSP service as recoverable via device reboot, accepting the streaming outage as the failure mode.