EUVD-2026-42648
GHSA-9ppp-4252-fggq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach camera RTSP port 554
-
DeliverySend crafted TEARDOWN request
-
ExploitOverflow stack buffer in RTSP parser
-
ExecutionCrash RTSP service
-
ImpactCamera denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network reachability to the Tenda CP3's RTSP service (typically TCP/554) on firmware V31.1.9.991 - no authentication, no user interaction, and no special configuration are needed, consistent with AV:N/AC:L/PR:N/UI:N. The concrete trigger is a crafted RTSP TEARDOWN request with an oversized field that overflows a stack buffer. The primary limiting factor is exposure: the attacker must have a network path to the RTSP port, so devices behind a firewall, on an isolated VLAN, or not Internet-exposed are not remotely reachable. Impact is also inherently limited to denial of service (device crash) - there is no code execution or data access from this flaw as described. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) describes an easily reachable, unauthenticated network attack with impact limited strictly to availability, yielding a base score of 7.5 (High). Publicly available exploit code exists per the referenced GitHub report, which raises practical risk, but this must be weighed against low real-world stakes: the maximum outcome is a crashed camera (DoS), not code execution or data theft, and there is no confidentiality or integrity impact. This CVE is not listed in CISA KEV and no EPSS probability was supplied, so widespread automated exploitation cannot be confirmed. Net assessment: a genuine but modest priority - trivially exploitable and POC-backed, yet the blast radius is a single device losing service, making it lower priority than a comparable RCE. Note the potential for physical-security consequences if the camera is relied upon for monitoring. |
| Exploit ScenarioDerived | An attacker who can reach the camera's RTSP port over the network sends a crafted TEARDOWN request containing an oversized field, overflowing a stack buffer and crashing the RTSP service. This knocks the camera offline, disabling video streaming and potentially creating a surveillance blind spot; a public proof-of-concept exists, and because no authentication is required, the attack can be scripted and repeated to keep the device down. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 09, 2026
Remote denial of service in the Tenda CP3 V3.0 IP camera (firmware V31.1.9.991) allows an unauthenticated attacker on the network to crash the device by sending a specially crafted RTSP TEARDOWN request that overflows a stack buffer. Publicly available exploit code exists via a third-party GitHub write-up, though the flaw affects only availability (no data disclosure or code execution is claimed). No active exploitation has been reported in CISA KEV, and EPSS data was not provided.
RemediationAI
No vendor-released patch identified at time of analysis - no Tenda advisory or fixed firmware version appears in the provided data, so a specific upgrade target cannot be cited. As compensating controls, restrict network access to the camera's RTSP service (typically TCP port 554) using firewall or ACL rules so it is reachable only from trusted management hosts or a dedicated VLAN; place all cameras on an isolated network segment with no direct Internet exposure, since this eliminates the unauthenticated remote reachability the attack depends on (trade-off: legitimate remote viewing must then go through a VPN or hardened gateway). Monitor the device for unexpected reboots or RTSP crashes as an indicator of exploitation, and check the Tenda security portal for firmware updates addressing CVE-2026-51605. The referenced proof-of-concept (https://github.com/kkkk2222874/cve_ID_report) should be reviewed to validate exposure.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the RTSP (Real Time Streaming Protocol) service embedded in the Tenda CP3, a consumer/SMB pan-tilt IP surveillance camera. RTSP (RFC 2326) is the control protocol used to negotiate and tear down media streams; the TEARDOWN method ends an established session. The root cause is CWE-121 (Stack-Based Buffer Overflow): the firmware copies attacker-controlled data from the TEARDOWN request into a fixed-size stack buffer without adequate bounds checking, corrupting the stack and crashing the service. The CPE string provided (cpe:2.3:a:n/a:n/a:*) is a placeholder and does not usefully identify the product; identification here relies on the description and references rather than structured CPE data.
Know when N A gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated remote TEARDOWN request over RTSP with low complexity (AV:N/AC:L/PR:N/UI:N); impact is device crash only, so C:N/I:N and A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.991) allows an unauthenticated remote attacker to cause a denial of service via a crafted TEARDOWN request.
Executive ViewAI
Tenda CP3 V3.0 IP cameras running firmware V31.1.9.991 are vulnerable to remote denial of service attacks that crash the device and disable surveillance capability. Network-based attackers can exploit this vulnerability without authentication, and publicly available exploit code increases the risk of opportunistic attacks. Organizations using these cameras for physical security should assess their exposure and implement interim protections immediately.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict RTSP access to trusted administrative subnets via firewall ACLs; (2) Disable RTSP protocol on cameras where not operationally critical; (3) Implement network monitoring to detect and alert on RTSP TEARDOWN requests; (4) Isolate camera network from general user network segments; (5) Monitor vendor advisory for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Exploit-DB