PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-51603 Tenda CVE debrief

CVE-2026-51603 is a stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91). An unauthenticated remote attacker can cause a denial of service via a crafted second SETUP request. To exploit this, the attacker must first complete OPTIONS, DESCRIBE, and a legitimate first SETUP request to obtain a valid session ID. The RTSP service's second-stage URL routing parser fails to validate the length of the URL field in the subsequent SETUP request. By supplying a URL consisting of exactly four consecutive repetitions of a valid RTSP URL, an attacker can bypass first-stage format validation and trigger a stack buffer overflow, causing an immediate crash of the RTSP service process and rendering the device inaccessible to all clients on the local network.

Vendor
Tenda
Product
CP3 V3.0
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-09
Original CVE updated
2026-07-10
Advisory published
2026-07-09
Advisory updated
2026-07-10

Who should care

Network administrators and security teams responsible for managing and securing Tenda CP3 V3.0 devices should be aware of this vulnerability. This vulnerability can be exploited to cause a denial of service, making the device inaccessible to all clients on the local network.

Technical summary

The vulnerability exists in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91). An attacker can exploit this by sending a crafted second SETUP request after completing the OPTIONS, DESCRIBE, and a legitimate first SETUP request. The RTSP service's second-stage URL routing parser does not validate the length of the URL field in the subsequent SETUP request, allowing an attacker to trigger a stack buffer overflow by supplying a specially crafted URL.

Defensive priority

High

Recommended defensive actions

  • Immediately apply the vendor's remediation or patch for Tenda CP3 V3.0 (firmware V31.1.9.91) if available.
  • Implement compensating controls such as network segmentation to limit the attack surface.
  • Monitor RTSP service logs for suspicious activity.
  • Restrict access to the RTSP service to only necessary personnel and systems.
  • Perform regular inventory checks to ensure all Tenda CP3 V3.0 devices are accounted for and up-to-date with the latest firmware.

Evidence notes

The CVE record was published on 2026-07-09T17:17:00.867Z and was last modified on 2026-07-10T17:41:47.303Z. The NVD entry is currently Deferred. Limited details are available about the affected scope and vendor remediation.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-09T17:17:00.867Z and has not been modified since then. The NVD entry is currently Deferred.