CVE-2026-51603

Name of the Vulnerable Software and Affected Versions Tenda CP3 V3.0 version V31.1.9.91

Description A stack-based buffer overflow occurs in the RTSP service when the second-stage URL routing parser fails to validate the length of the URL field in a SETUP request. An unauthenticated remote attacker can trigger this by first completing OPTIONS, DESCRIBE, and an initial legitimate SETUP request to obtain a session ID, then sending a second SETUP request containing a URL consisting of four consecutive repetitions of a valid RTSP URL. This bypasses first-stage format validation and causes the RTSP service process to crash, resulting in a denial of service that makes the device inaccessible to all clients on the local network.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.