Tenda CP3 EUVD-2026-42646

The RTSP service must be network-reachable (typically TCP 554) and the attacker must first complete a legitimate RTSP handshake - OPTIONS, DESCRIBE, and a valid first SETUP request to obtain a live session ID - before sending the malicious payload. The specific trigger is a second SETUP request whose URL field consists of exactly four consecutive repetitions of a valid RTSP URL, which bypasses the first-stage format validation and reaches the unbounded second-stage URL routing parser. No authentication or credentials are required (PR:N) and no user interaction is needed (UI:N). Limiting factors: exploitation is bounded to the local network reachable to the device, requires the multi-step handshake rather than a single stray packet, and impact is confined to a service crash (availability only, A:H) with no code execution or data exposure indicated in the description.

Signals are internally consistent and point to a moderate, availability-only issue rather than a critical one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) reflects unauthenticated network reachability with no confidentiality or integrity impact - the sole consequence is service crash. SSVC agrees: exploitation status 'poc' (not active), 'automatable: yes' (the fixed handshake can be scripted), and 'partial' technical impact (consistent with DoS, not full compromise). No EPSS score and no KEV listing were provided, so there is no evidence of widespread or active exploitation; the only exploitation signal is public POC code. Note a mild nuance the raw score hides: exploitation requires completing a legitimate multi-step RTSP handshake (OPTIONS/DESCRIBE/first SETUP) to obtain a valid session ID before the malicious second SETUP, which is slightly more involved than a single unauthenticated packet, but this does not raise attack complexity materially since no secret or user interaction is needed. Realistic priority is moderate: high impact on the specific device's availability, but confined to a niche IP-camera product reachable on the local network.

An attacker with network reachability to a Tenda CP3 camera's RTSP port completes a normal OPTIONS, DESCRIBE, and first SETUP exchange to obtain a valid session ID, then sends a second SETUP request whose URL is exactly four consecutive repetitions of a valid RTSP URL. This over-long URL bypasses first-stage format validation and overflows a stack buffer in the second-stage router, immediately crashing the RTSP process and cutting off video for all clients until the device is restarted. Publicly available exploit code demonstrating this handshake exists, making the attack readily reproducible and scriptable.