Stack-Based Buffer Overflow in Tenda CP3 V3.0 Firmware

Executive Summary

CVE-2026-51601 is a stack-based buffer overflow vulnerability found in the RTSP service of the Tenda CP3 V3.0 IP camera running firmware version V31.1.9.91.

The vulnerability occurs when the device processes a PLAY request containing a Range header with an excessively long clock= value. The device does not properly validate the length of this value, which leads to a stack-based buffer overflow.

An attacker can exploit this by completing a standard RTSP session handshake and then sending a PLAY request with a clock= field payload of 664 bytes or longer. This causes the RTSP service to crash, making the device's RTSP service unreachable.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability results in a denial-of-service (DoS) condition by crashing the RTSP service on the device.

When the RTSP service crashes, TCP port 554 becomes unreachable, causing all clients on the local network, including official applications and third-party players like VLC, to lose connectivity to the device.

This means legitimate users cannot access the camera's video stream until the device is restarted or the service is restored.

Additionally, the vulnerability poses a memory corruption risk due to the stack-based buffer overflow, which could potentially be leveraged for further attacks, although no such exploits are detailed here.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring the RTSP service on TCP port 554 for crashes or unresponsiveness following a PLAY request with a malformed Range header containing an excessively long clock= value.

One way to detect exploitation attempts is to observe if the RTSP service process crashes or if the port 554 becomes unreachable, causing denial of service for RTSP clients.

A proof-of-concept script exists that sends a PLAY request with a 664-byte or longer payload in the clock= field after completing a standard RTSP handshake (OPTIONS → DESCRIBE → SETUP × 2), which can be used to test if the device is vulnerable.

• Use network monitoring tools (e.g., tcpdump or Wireshark) to capture RTSP traffic on port 554 and look for unusually long clock= values in PLAY requests.
• Check the availability of the RTSP service on port 554 using commands like `nc -vz <device_ip> 554` or `telnet <device_ip> 554` to see if the service is responsive.
• Use RTSP client tools or scripts to perform the RTSP handshake and send a crafted PLAY request with a long clock= value to test for crashes.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the RTSP service on TCP port 554 to trusted networks or hosts only, to prevent unauthenticated remote attackers from exploiting the vulnerability.

Monitor the RTSP service for crashes or denial of service conditions and restart the service if necessary to restore functionality.

If possible, disable the RTSP service temporarily until a firmware update or patch addressing the vulnerability is available.

Apply any available firmware updates from the vendor that fix the buffer overflow vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0