Tenda CP3 V3.0 31.1.9.91 RTSP Service URL stack-based overflow

Summaryinfo

A vulnerability categorized as critical has been discovered in Tenda CP3 V3.0 31.1.9.91. The impacted element is an unknown function of the component RTSP Service. Such manipulation of the argument URL leads to stack-based overflow. This vulnerability is uniquely identified as CVE-2026-51602. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Tenda CP3 V3.0 31.1.9.91. It has been rated as critical. Affected by this issue is an unknown functionality of the component RTSP Service. The manipulation of the argument URL with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is availability. CVE summarizes:

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted SETUP request. The RTSP service's second-stage URL routing parser fails to validate the length of the URL field in the first SETUP request. By supplying a URL consisting of exactly four consecutive repetitions of a valid RTSP URL, an attacker can bypass first-stage format validation and trigger a stack buffer overflow, causing an immediate crash of the RTSP service process and rendering the device inaccessible to all clients on the local network.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-51602 since 06/08/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/09/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Tenda

Name

• CP3 V3.0

Version

• 31.1.9.91

License

• commercial

Website

• Vendor: https://www.tenda.com.cn/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion