CVE-2026-51601

HIGH

Tenda CP3 V31.1.9.91 - Unauthenticated Denial of Service via RTSP Range Header clock= Value Overflow

Title source: llm

Description

Tenda CP3 V3.0 firmware V31.1.9.91 contains a stack-based buffer overflow in the RTSP service. The device fails to validate the length of the clock= value in the Range header field when processing a PLAY request. An unauthenticated remote attacker who has completed a standard RTSP session handshake can send a PLAY request with an excessively long clock= value to cause the RTSP service to crash.

References (1)

Core 1

Core References

https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_2th/README.md

View Writeup ZIP pw:eip

Scores

CVSS v3 7.5

EPSS 0.0041

EPSS Percentile 33.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-121

Status published

Published Jul 09, 2026

Tracked Since Jul 09, 2026