EUVD-2026-42647
GHSA-xcpq-fjmw-996v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach camera RTSP port (TCP 554)
-
DeliverySend crafted RTSP PLAY request
-
ExploitOverflow fixed-size stack buffer
-
ExecutionCrash RTSP service
-
ImpactCamera offline / reboot (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the RTSP service of a Tenda CP3 V3.0 running firmware V31.1.9.91 - specifically the ability to send an RTSP PLAY request to the camera's RTSP listener (commonly TCP port 554). No authentication (PR:N), no user interaction (UI:N), and no non-default configuration are required, since RTSP streaming is core camera functionality. The primary limiting factor is exposure: the attacker must have a network path to the RTSP port, so cameras confined to an isolated/segmented LAN are only reachable by on-network attackers, while internet-exposed cameras are reachable by anyone. Impact is limited to denial of service (device crash/reboot); this condition does not grant code execution or data access based on available data. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5 HIGH) is internally consistent: network-reachable, low complexity, no privileges, and an availability-only impact - this reads as a reliable remote crash rather than a system-compromise bug. No EPSS score was supplied, and the CVE is not in CISA KEV, so there is no evidence of active exploitation; treat exploitation status as 'no public exploit identified' by KEV standards, though a GitHub research report exists that likely contains proof-of-concept steps. The realistic risk is moderate: exploitation is trivial and unauthenticated, but the payoff is only a device outage (camera goes offline / reboots), not data theft or code execution. Note a limitation: stack overflows can sometimes be escalated to code execution, but the description and CVSS explicitly scope impact to availability (C:N/I:N) - do not assume RCE without further evidence. Priority should be driven by exposure: cameras with RTSP reachable from untrusted networks warrant prompt attention, otherwise this is a manage-in-normal-cycle issue. |
| Exploit ScenarioDerived | An attacker who can reach the camera's RTSP port (for example, an internet-exposed device found via a scan, or an insider on the same LAN) sends a single crafted RTSP PLAY request whose oversized field overflows the stack buffer, crashing the RTSP service and knocking the camera offline or forcing a reboot. Because no authentication or user interaction is needed and complexity is low, the attack is highly reliable and can be scripted to repeatedly deny video availability. A public GitHub report documents the issue and likely includes proof-of-concept reproduction steps. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 09, 2026
Denial of service in the Tenda CP3 V3.0 IP camera (firmware V31.1.9.91) allows an unauthenticated remote attacker to crash the RTSP service by sending a crafted PLAY request that overflows a fixed-size stack buffer. The flaw is remotely reachable with no authentication or user interaction, but per the description and CVSS the impact is limited to availability loss (device crash/reboot), with no confirmed code execution. A public technical report with reproduction details exists on GitHub; the issue is not listed in CISA KEV and no EPSS score was provided.
RemediationAI
No vendor-released patch identified at time of analysis - no Tenda advisory or fixed firmware version was supplied in the source data, so monitor Tenda's official support/download portal for firmware superseding V31.1.9.91 and apply it once released. As compensating controls, the most effective mitigation is to remove the RTSP service from untrusted exposure: block inbound access to the RTSP port (typically TCP 554) at the network firewall and never expose the camera directly to the internet, which prevents remote reach at the cost of losing remote/off-LAN live streaming. Place the camera on an isolated VLAN and restrict RTSP access to a small allowlist of trusted NVR/management hosts, accepting the operational overhead of segmentation. If remote viewing is required, tunnel it over a VPN rather than exposing RTSP directly. Consult the public technical report at https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_6th/README.md for reproduction details to validate any fix.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the RTSP (Real Time Streaming Protocol) server embedded in the Tenda CP3, a consumer/SMB network security camera. RTSP is the control protocol used to negotiate and manage media streams, and the PLAY method instructs the server to begin transmitting a stream. The root cause is CWE-121 (Stack-based Buffer Overflow): the RTSP handler copies attacker-controlled data from the PLAY request into a fixed-size buffer on the call stack without adequate bounds checking, corrupting the stack frame. The provided CPE string (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not identify the product; the affected product is established from the description as Tenda CP3 V3.0, firmware V31.1.9.91.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
RTSP is network-reachable with no auth or interaction and a low-complexity crash, but the described impact is availability-only, so C:N/I:N/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted PLAY request.
Executive ViewAI
Tenda CP3 V3.0 IP cameras running firmware V31.1.9.91 are vulnerable to a remote denial-of-service attack that crashes the RTSP video stream service without requiring authentication, directly disrupting surveillance capabilities. With no vendor patch available and publicly documented reproduction details, affected organizations face immediate availability risk to critical security infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Network segmentation-restrict RTSP protocol (TCP/UDP 554) access to dedicated security monitoring network only; (2) Disable RTSP service if real-time pull access is not operationally required; (3) Implement connection rate limiting and anomalous request monitoring for RTSP; (4) Monitor device logs for repeated connection failures or reboot cycles; (5) Evaluate timeline for replacement with vendors providing timely security updates.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB