Stack-Based Buffer Overflow in Tenda CP3 Router

Compliance Impact

The vulnerability causes a denial of service by crashing the RTSP service on the Tenda CP3 V3.0 device, rendering it inaccessible to clients on the local network. While it does not directly compromise confidentiality or integrity of data, the resulting service disruption could impact availability, which is a key aspect of compliance with standards like GDPR and HIPAA.

Specifically, the denial of service could interfere with the continuous operation of security or monitoring systems relying on the device, potentially leading to non-compliance with regulations that require maintaining availability and reliability of security controls.

However, there is no direct indication from the provided information that this vulnerability leads to unauthorized data access or disclosure, which are primary concerns under GDPR and HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-51602 is a stack-based buffer overflow vulnerability found in the RTSP service of the Tenda CP3 V3.0 IP camera, specifically in firmware version V31.1.9.91.

The flaw occurs in the second-stage URL parsing logic of the SETUP request handler, which does not properly validate the length of the URL field.

An attacker can send a specially crafted SETUP request containing a URL made up of four consecutive repetitions of a valid RTSP URL. This bypasses the initial format validation and triggers a stack buffer overflow.

As a result, the RTSP service process crashes immediately, causing TCP port 554 to become unresponsive and denying service to all clients on the local network.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated remote attacker to cause a denial of service on the affected device by crashing the RTSP service.

When exploited, the RTSP service process crashes, making the device inaccessible to all clients on the local network, including official apps and third-party media players.

Additionally, because the overflow is stack-based, there is a potential risk that an attacker could escalate the impact to remote code execution, although the proof-of-concept currently demonstrates denial of service.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring the RTSP service on TCP port 554 for unresponsiveness or crashes following malformed SETUP requests.

An attacker exploits the vulnerability by sending a crafted SETUP request with a URL field consisting of four consecutive repetitions of a valid RTSP URL, which bypasses initial format validation and triggers a stack buffer overflow.

To detect exploitation attempts, you can use network traffic capture tools like tcpdump or Wireshark to monitor RTSP traffic on port 554 and look for SETUP requests with unusually long or repeated URL fields.

• Use tcpdump to capture RTSP traffic: tcpdump -i <interface> tcp port 554 -w rtsp_traffic.pcap
• Analyze captured traffic with Wireshark to inspect SETUP requests for repeated URL patterns.
• Check the availability of the RTSP service by attempting to connect to port 554; repeated crashes or unresponsiveness may indicate exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the RTSP service on TCP port 554 to trusted networks or hosts only, to prevent unauthenticated remote attackers from sending malicious SETUP requests.

If possible, disable the RTSP service temporarily until a firmware update or patch addressing this vulnerability is available.

Monitor the device for crashes or unresponsiveness of the RTSP service and consider network-level protections such as firewall rules to block suspicious RTSP traffic.

Contact the vendor or check for firmware updates that fix the input validation flaw in the RTSP service.

Useful 0 Not Useful 0