RTSP Request Handling DoS in Tenda CP3 V3.0 Firmware

Executive Summary

CVE-2026-51600 is a vulnerability in the RTSP service of the Tenda CP3 V3.0 IP camera running firmware version V31.1.9.91. The device fails to properly validate the Content-Length header in RTSP requests, such as DESCRIBE and SETUP methods, which according to protocol standards should not include a message body.

When an RTSP request includes a Content-Length header but lacks the corresponding message body, the device's RTSP parser waits indefinitely for the body to arrive. This causes the TCP connection to become permanently non-functional because the device silently consumes all subsequent data as body content without closing the connection.

This behavior leads to a TCP resource leak and can be exploited by an unauthenticated remote attacker to cause a denial-of-service condition on the device.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the vulnerability in Tenda CP3 V3.0 firmware V31.1.9.91, immediate steps include restricting access to the RTSP service from untrusted networks to prevent unauthenticated remote attackers from exploiting the issue.

Additionally, monitoring and limiting the number of concurrent TCP connections to the RTSP service can help reduce the impact of potential resource exhaustion.

If possible, applying firmware updates or patches from the vendor that address the Content-Length header validation issue is recommended once available.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can be exploited by an unauthenticated remote attacker to cause a denial-of-service (DoS) condition on the affected Tenda CP3 V3.0 device.

By sending malformed RTSP requests with a Content-Length header but no message body, the attacker can cause the device's RTSP service to hang indefinitely, making the TCP connection permanently non-functional.

As the device does not close these connections, it leads to resource exhaustion (TCP resource leak), potentially disrupting normal device operation and availability.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending malformed RTSP requests to the Tenda CP3 V3.0 device, specifically RTSP methods like DESCRIBE or SETUP that include a Content-Length header but omit the corresponding message body. Observing whether the device's TCP connection becomes non-functional or hangs indefinitely indicates the presence of the vulnerability.

A proof-of-concept involves sending a DESCRIBE request with a Content-Length header but no body and monitoring the device's response or connection state.

While specific commands are not provided, a typical approach would be to use tools like netcat (nc) or curl to craft and send such RTSP requests manually or via a script.

Useful 0 Not Useful 0