Tenda CP3 CVE-2026-51602

Exploitation requires network reachability to the Tenda CP3 V3.0 RTSP service (default RTSP port, typically TCP 554) on a device running firmware V31.1.9.91; per CVSS PR:N/UI:N no authentication or user interaction is needed, and the trigger is a single crafted SETUP request whose URL is exactly four consecutive repetitions of a valid RTSP URL - that precise malformed-URL structure is the concrete prerequisite that bypasses first-stage format validation. The primary limiting factor is exposure scope: the description frames impact as affecting clients 'on the local network,' so realistic exploitation requires the attacker to be on the same LAN/segment as the camera unless the RTSP port has been forwarded to a wider network; impact is limited to availability (service crash/DoS) with no data disclosure or code execution.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5 High) captures the essential profile: network-reachable, low complexity, no privileges or user interaction, but availability-only impact - no confidentiality or integrity loss. This is a pure denial-of-service, not code execution, so the 7.5 score is driven entirely by A:H. SSVC reinforces a modest-but-real posture: Exploitation is rated 'poc' (proof-of-concept exists, not active), Automatable 'yes' (the single-shot unauthenticated trigger scales trivially), and Technical Impact 'partial' (service crash rather than full system control). No EPSS score and no KEV entry are provided, so there is no evidence of in-the-wild exploitation; the realistic risk is a locally reachable, easily automated service-crash rather than a remote-takeover emergency. A key caveat: although the CVSS marks AV:N, the description repeatedly frames impact as affecting 'all clients on the local network,' implying exposure is typically LAN-scoped unless the RTSP port is deliberately forwarded to the internet - verify actual network exposure before prioritizing.

An attacker with network reach to the camera (typically a device on the same LAN, or the internet if RTSP port 554 is forwarded) sends a single crafted RTSP SETUP request whose URL is four back-to-back copies of a valid RTSP URL. The malformed URL passes first-stage format validation but overflows a stack buffer in the second-stage parser, instantly crashing the RTSP process and knocking video streaming offline for every client. A proof-of-concept is described in the public researcher write-up, and the single-packet, unauthenticated nature makes the attack trivial to script and repeat.