What is the CVSS score of CVE-2026-51604?

CVE-2026-51604 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Tenda CP3 are affected by CVE-2026-51604?

Tenda CP3 V3.0 IP cameras running firmware V31.1.9.91 are vulnerable to a remote denial-of-service attack that crashes the RTSP video stream service without requiring authentication, directly…

How to fix or mitigate CVE-2026-51604?

Within 24 hours: Inventory all Tenda CP3 V3.0 devices running firmware V31.1.9.91 and their network locations; assess surveillance coverage gaps. Within 7 days: Implement network segmentation to restrict RTSP (port 554) access to authorized systems only; disable RTSP service on cameras where video pull is not operationally required; enable connection rate limiting at the network perimeter. Within 30 days: Contact Tenda for available firmware updates beyond V31.1.9.91; evaluate migration to alternative camera vendors with established security patch cadences.

Tenda CP3 CVE-2026-51604

EUVD-2026-42647 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-09 mitre

GHSA-xcpq-fjmw-996v

Buffer Overflow Tenda Denial Of Service Stack Overflow N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

RTSP is network-reachable with no auth or interaction and a low-complexity crash, but the described impact is availability-only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 18:54 vuln.today

CVSS changed

Jul 09, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Jul 09, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted PLAY request.

AnalysisAI

Denial of service in the Tenda CP3 V3.0 IP camera (firmware V31.1.9.91) allows an unauthenticated remote attacker to crash the RTSP service by sending a crafted PLAY request that overflows a fixed-size stack buffer. The flaw is remotely reachable with no authentication or user interaction, but per the description and CVSS the impact is limited to availability loss (device crash/reboot), with no confirmed code execution. A public technical report with reproduction details exists on GitHub; the issue is not listed in CISA KEV and no EPSS score was provided.

Technical ContextAI

The affected component is the RTSP (Real Time Streaming Protocol) server embedded in the Tenda CP3, a consumer/SMB network security camera. RTSP is the control protocol used to negotiate and manage media streams, and the PLAY method instructs the server to begin transmitting a stream. The root cause is CWE-121 (Stack-based Buffer Overflow): the RTSP handler copies attacker-controlled data from the PLAY request into a fixed-size buffer on the call stack without adequate bounds checking, corrupting the stack frame. The provided CPE string (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not identify the product; the affected product is established from the description as Tenda CP3 V3.0, firmware V31.1.9.91.

RemediationAI

No vendor-released patch identified at time of analysis - no Tenda advisory or fixed firmware version was supplied in the source data, so monitor Tenda's official support/download portal for firmware superseding V31.1.9.91 and apply it once released. As compensating controls, the most effective mitigation is to remove the RTSP service from untrusted exposure: block inbound access to the RTSP port (typically TCP 554) at the network firewall and never expose the camera directly to the internet, which prevents remote reach at the cost of losing remote/off-LAN live streaming. Place the camera on an isolated VLAN and restrict RTSP access to a small allowlist of trusted NVR/management hosts, accepting the operational overhead of segmentation. If remote viewing is required, tunnel it over a VPN rather than exposing RTSP directly. Consult the public technical report at https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_6th/README.md for reproduction details to validate any fix.