CVE-2026-51606 Tenda CVE debrief

Who should care

Users of Tenda CP3 V3.0 (firmware V31.1.9.91) should be aware of this vulnerability and take necessary precautions to prevent exploitation. This includes confirming whether affected product deployments exist in managed environments and assigning an owner for follow-up. Additionally, users should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The vulnerability is caused by improper input handling in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91). When a request with an oversized field value is received, the device terminates the TCP connection with a RST packet without returning an RFC 2326-compliant error response. This affects the request-line URL field and header field values across multiple RTSP request types. The vulnerability has a CVSS score of 7.5 and is considered HIGH severity. Users of Tenda CP3 V3.0 (firmware V31.1.9.91) should be aware of this vulnerability and take necessary precautions to prevent exploitation.

Defensive priority

High priority should be given to patching or mitigating this vulnerability, as it could potentially be exploited to disrupt RTSP service on affected devices. Monitoring and compensating controls are recommended while remediation is scheduled and verified. Review vendor-supported updates or mitigations through normal change control where exposure is confirmed. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Consider implementing additional security controls, such as network segmentation or intrusion detection, to further protect against potential exploitation. Limit access to the RTSP service to trusted networks or IP addresses to reduce the attack surface. Users of Tenda CP3 V3.0 (firmware V31.1.9.91) should be aware of this vulnerability and take necessary precautions to prevent exploitation. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Review compensating controls for exposed systems while remediation is scheduled and verified. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. This vulnerability has a CVSS score of 7.5 and is considered HIGH severity. The vulnerability is caused by improper input handling in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91). When a request with an oversized field value is received, the device terminates the TCP connection with a RST packet without returning an RFC 2326-compliant error response. This affects the request-line URL field and header field values across multiple RTSP request types. Users of Tenda CP3 V3.0 (firmware V31.1.9.91) should be aware of this vulnerability and take necessary precautions to prevent exploitation. The CVE record was published on 2026-07-09T17:17:01.173Z and last modified on 2026-07-10T17:41:47.303Z. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD information. Defenders should verify affected product deployments,

Recommended defensive actions

• Apply the latest firmware update for Tenda CP3 V3.0
• Limit access to the RTSP service to trusted networks or IP addresses
• Monitor RTSP service logs for unusual activity
• Consider implementing additional security controls, such as network segmentation or intrusion detection
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-09T17:17:01.173Z and last modified on 2026-07-10T17:41:47.303Z. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD information. Defenders should verify affected product deployments and review official advisories for validation.

Official resources