What is the CVSS score of CVE-2026-51605?

CVE-2026-51605 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Tenda CP3 are affected by CVE-2026-51605?

Tenda CP3 V3.0 IP cameras running firmware V31.1.9.991 are vulnerable to remote denial of service attacks that crash the device and disable surveillance capability.

How to fix or mitigate CVE-2026-51605?

Within 24 hours: Audit network inventory for affected Tenda CP3 cameras; restrict RTSP protocol access via firewall rules to only trusted administrative networks. Within 7 days: Disable RTSP service on cameras if not operationally required; implement network segmentation to isolate camera infrastructure; configure logging to detect RTSP TEARDOWN requests. Within 30 days: Contact Tenda for patch availability and timeline; evaluate alternative camera solutions or plan device replacement if vendor support is unavailable.

Tenda CP3 CVE-2026-51605

EUVD-2026-42648 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-09 mitre

GHSA-9ppp-4252-fggq

Buffer Overflow Tenda Denial Of Service Stack Overflow N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated remote TEARDOWN request over RTSP with low complexity (AV:N/AC:L/PR:N/UI:N); impact is device crash only, so C:N/I:N and A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 18:53 vuln.today

CVSS changed

Jul 09, 2026 - 18:22 NVD

7.5 (HIGH)

CVE Published

Jul 09, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.991) allows an unauthenticated remote attacker to cause a denial of service via a crafted TEARDOWN request.

AnalysisAI

Remote denial of service in the Tenda CP3 V3.0 IP camera (firmware V31.1.9.991) allows an unauthenticated attacker on the network to crash the device by sending a specially crafted RTSP TEARDOWN request that overflows a stack buffer. Publicly available exploit code exists via a third-party GitHub write-up, though the flaw affects only availability (no data disclosure or code execution is claimed). No active exploitation has been reported in CISA KEV, and EPSS data was not provided.

Technical ContextAI

The affected component is the RTSP (Real Time Streaming Protocol) service embedded in the Tenda CP3, a consumer/SMB pan-tilt IP surveillance camera. RTSP (RFC 2326) is the control protocol used to negotiate and tear down media streams; the TEARDOWN method ends an established session. The root cause is CWE-121 (Stack-Based Buffer Overflow): the firmware copies attacker-controlled data from the TEARDOWN request into a fixed-size stack buffer without adequate bounds checking, corrupting the stack and crashing the service. The CPE string provided (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not usefully identify the product; identification here relies on the description and references rather than structured CPE data.

RemediationAI

No vendor-released patch identified at time of analysis - no Tenda advisory or fixed firmware version appears in the provided data, so a specific upgrade target cannot be cited. As compensating controls, restrict network access to the camera's RTSP service (typically TCP port 554) using firewall or ACL rules so it is reachable only from trusted management hosts or a dedicated VLAN; place all cameras on an isolated network segment with no direct Internet exposure, since this eliminates the unauthenticated remote reachability the attack depends on (trade-off: legitimate remote viewing must then go through a VPN or hardened gateway). Monitor the device for unexpected reboots or RTSP crashes as an indicator of exploitation, and check the Tenda security portal for firmware updates addressing CVE-2026-51605. The referenced proof-of-concept (https://github.com/kkkk2222874/cve_ID_report) should be reviewed to validate exposure.