CVE-2026-19749

Deferred Deferred - Pending Action

Authentication Bypass in Tenda Network Devices

Publication date: 2026-08-13

Last updated on: 2026-08-18

Assigner: VulDB

Description

A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability is an unknown functionality of the component RTSP/ONVIF. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is now public and may be used.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-18

Generated

2026-09-03

AI Q&A

2026-08-14

EPSS Evaluated

2026-09-01

NVD

CVE-2026-19749

Affected Vendors & Products

Vendor	Product	Version / Range
tenda	ch7	to 20260625 (inc)
tenda	ch7g	to 20260625 (inc)
tenda	ch10	to 20260625 (inc)
tenda	cp3	to 20260625 (inc)
tenda	cp3_pro	to 20260625 (inc)
tenda	cp7	to 20260625 (inc)
tenda	tc3b14c	to 20260625 (inc)
tenda	tc3b15c	to 20260625 (inc)
tenda	tc3t14c	to 20260625 (inc)
tenda	tc3t15c	to 20260625 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

A vulnerability in multiple Tenda devices allows remote attackers to bypass authentication due to a flaw in the RTSP/ONVIF component. The attack requires high complexity and is difficult to exploit, but a public exploit exists.

Detection Guidance

Detecting this vulnerability requires checking for exposed RTSP/ONVIF services on affected Tenda devices. Use network scanning tools like nmap to identify open ports 554 (RTSP) or 80 (HTTP) on devices matching the listed models. Example command: nmap -p 554,80 -sV <target_IP>. Verify if authentication is missing by attempting to access RTSP streams without credentials.

Impact Analysis

An attacker could gain unauthorized access to affected Tenda devices, potentially allowing them to control or monitor the device remotely without authentication.

Compliance Impact

This vulnerability allows remote attackers to bypass authentication in RTSP/ONVIF components of affected Tenda devices. Missing authentication could lead to unauthorized access to video feeds or device controls, potentially exposing sensitive data. This may violate GDPR's data protection requirements for secure processing and HIPAA's safeguards for protected health information if such data is involved.

Mitigation Strategies

Immediately update affected Tenda devices to the latest firmware version available beyond 20260625. Disable RTSP and ONVIF services if not required. Isolate vulnerable devices from critical network segments. Monitor network traffic for unauthorized access attempts to RTSP/ONVIF ports.

Hi! I’m here to help you understand CVE-2026-19749. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70