What is the CVSS score of CVE-2026-51602?

CVE-2026-51602 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Tenda CP3 are affected by CVE-2026-51602?

Tenda CP3 V3.0 IP cameras running firmware V31.1.9.91 are vulnerable to unauthenticated remote denial-of-service attacks that disable the RTSP streaming service on affected devices.

How to fix or mitigate CVE-2026-51602?

Within 24 hours: Inventory all Tenda CP3 V3.0 cameras running firmware V31.1.9.91; restrict RTSP port access to authorized management networks only and segment cameras to an isolated VLAN if feasible. Within 7 days: Contact Tenda support for patch availability timeline and interim workarounds; evaluate replacement camera platforms if surveillance is mission-critical. Within 30 days: Deploy vendor-released patch once available or implement device replacement; establish monitoring for RTSP service anomalies; document network isolation controls.

Tenda CP3 CVE-2026-51602

EUVD-2026-42645 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-09 cve@mitre.org

GHSA-55vc-29g2-vffg

Buffer Overflow Tenda Denial Of Service Stack Overflow

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated single-request trigger over the network gives AV:N/AC:L/PR:N/UI:N; impact is a service crash only, so C:N/I:N/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 19:33 vuln.today

CVSS changed

Jul 09, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Jul 09, 2026 - 17:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted SETUP request. The RTSP service's second-stage URL routing parser fails to validate the length of the URL field in the first SETUP request. By supplying a URL consisting of exactly four consecutive repetitions of a valid RTSP URL, an attacker can bypass first-stage format validation and trigger a stack buffer overflow, causing an immediate crash of the RTSP service process and rendering the device inaccessible to all clients on the local network.

AnalysisAI

Denial of service in the RTSP service of Tenda CP3 V3.0 IP cameras (firmware V31.1.9.91) allows an unauthenticated remote attacker on the local network to crash the streaming service with a single crafted SETUP request. Because the second-stage URL routing parser does not validate the URL field length, a request whose URL is exactly four repetitions of a valid RTSP URL overflows a stack buffer and terminates the RTSP process, cutting off all clients. Publicly available exploit code exists (researcher write-up on GitHub); this is not listed in CISA KEV and no active exploitation is confirmed.

Technical ContextAI

The affected component is the Real Time Streaming Protocol (RTSP, RFC 2326) server embedded in the Tenda CP3 network camera firmware, which handles session negotiation methods such as SETUP for delivering video streams to clients. The root cause is CWE-121 (stack-based buffer overflow): the firmware performs URL handling in two stages, and while the first stage enforces a format check, the second-stage routing parser copies the request URL into a fixed-size stack buffer without validating its length. Crafting the URL as four consecutive copies of an otherwise-valid RTSP URL satisfies first-stage format validation while producing an over-length string that the second stage copies unchecked, corrupting the stack and crashing the process. This is a classic missing-bounds-check pattern common in resource-constrained embedded IoT/camera firmware written in C.

RemediationAI

No vendor-released patch is identified at time of analysis - the only reference is a researcher write-up (https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_3th/README.md), and no fixed firmware version is provided, so monitor Tenda for an updated firmware release beyond V31.1.9.91 and apply it once published. In the interim, apply compensating controls: place affected CP3 cameras on an isolated VLAN or dedicated camera network segment and block or firewall the RTSP port (TCP 554) from all hosts that do not require streaming access, which prevents arbitrary clients from reaching the vulnerable SETUP handler at the cost of restricting legitimate viewers to the allow-listed segment. Do not expose the RTSP service to the internet via port forwarding or UPnP; disabling any WAN-side forwarding of port 554 removes remote reachability with no loss of LAN functionality. Because the crash is a DoS, an automated watchdog or scheduled reboot can restore streaming after an attack but does not prevent repeated disruption, so it is a stopgap only.