What is the CVSS score of CVE-2026-51603?

CVE-2026-51603 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Tenda CP3 are affected by CVE-2026-51603?

Tenda CP3 V3.0 IP cameras running firmware V31.1.9.91 can be remotely crashed via a crafted RTSP request, forcing the camera offline and disrupting surveillance monitoring for all network clients.

How to fix or mitigate CVE-2026-51603?

Within 24 hours: Identify and document all Tenda CP3 V3.0 cameras with firmware V31.1.9.91 in your environment and their network exposure. Within 7 days: Implement network-level controls-restrict RTSP (TCP/UDP 554) access to trusted administrators only via firewall rules, or disable RTSP service entirely if not operationally necessary. Within 30 days: Escalate to Tenda for firmware patch timeline; if no vendor update is available by day 60, evaluate hardware replacement or failover architectures.

Tenda CP3 CVE-2026-51603

EUVD-2026-42646 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-09 cve@mitre.org

GHSA-vmqq-vpj5-fgxw

Buffer Overflow Tenda Denial Of Service Stack Overflow

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable RTSP service (AV:N/PR:N/UI:N); scriptable fixed handshake keeps AC:L; impact is solely a service crash, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 19:34 vuln.today

CVSS changed

Jul 09, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Jul 09, 2026 - 17:17 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted second SETUP request. After completing the OPTIONS, DESCRIBE, and a legitimate first SETUP request to obtain a valid session ID, the RTSP service's second-stage URL routing parser fails to validate the length of the URL field in the subsequent SETUP request. By supplying a URL consisting of exactly four consecutive repetitions of a valid RTSP URL, an attacker can bypass first-stage format validation and trigger a stack buffer overflow, causing an immediate crash of the RTSP service process and rendering the device inaccessible to all clients on the local network.

AnalysisAI

Denial of service in the Tenda CP3 V3.0 IP camera (firmware V31.1.9.91) lets an unauthenticated remote attacker crash the RTSP service by sending a crafted second SETUP request after a valid RTSP handshake, knocking the camera offline for every client on the network. The flaw is a stack-based buffer overflow (CWE-121) in the RTSP second-stage URL routing parser; publicly available exploit code exists via a GitHub write-up, though no active exploitation is confirmed and the CVSS availability-only impact means it is a crash, not code execution, at time of analysis.

Technical ContextAI

The affected component is the Real Time Streaming Protocol (RTSP) service embedded in the Tenda CP3 V3.0 network security camera. RTSP negotiates media sessions through a sequence of methods (OPTIONS, DESCRIBE, SETUP, PLAY); this device implements a two-stage request parser where an initial SETUP obtains a session ID and a subsequent SETUP is routed through a second-stage URL parser. Per CWE-121 (Stack-based Buffer Overflow), the root cause is missing bounds validation: the second-stage router copies the request URL into a fixed-size stack buffer without checking its length, so an over-long URL overwrites adjacent stack memory and corrupts the process. The EUVD record lists affected versions as 'n/a', so precise product identification relies on the CVE description naming Tenda CP3 V3.0 firmware V31.1.9.91 rather than structured CPE data.

RemediationAI

No vendor-released patch identified at time of analysis - no fixed firmware version or Tenda advisory was present in the source data, so monitor Tenda's support portal for a firmware update superseding V31.1.9.91 and apply it once released. As compensating controls, restrict network access to the camera's RTSP service (typically TCP port 554) using firewall or VLAN segmentation so only authorized streaming clients (NVR/VMS) can reach it, which prevents arbitrary hosts from initiating the handshake at the cost of requiring an explicit allowlist for legitimate viewers; place the camera on an isolated management/IoT network segment rather than a routable or internet-facing one, accepting the operational overhead of segmented routing; and if RTSP streaming is not required, disable the RTSP service to eliminate the attack surface entirely, with the trade-off of losing live streaming to standard RTSP clients. Technical details and the proof-of-concept are documented at https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_4th/README.md.