CVE-2026-19749
Received
Received - Intake
Authentication Bypass in Tenda Network Devices
Vulnerability report for CVE-2026-19749, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-08-13
Last updated on: 2026-08-13
Assigner: VulDB
Description
Description
A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability is an unknown functionality of the component RTSP/ONVIF. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is now public and may be used.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| tenda | ch7 | to 20260625 (inc) |
| tenda | ch7g | to 20260625 (inc) |
| tenda | ch10 | to 20260625 (inc) |
| tenda | cp3 | to 20260625 (inc) |
| tenda | cp3_pro | to 20260625 (inc) |
| tenda | cp7 | to 20260625 (inc) |
| tenda | tc3b14c | to 20260625 (inc) |
| tenda | tc3b15c | to 20260625 (inc) |
| tenda | tc3t14c | to 20260625 (inc) |
| tenda | tc3t15c | to 20260625 (inc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
