Executive brief
A vulnerability in Tenda CP3 security cameras allows an attacker to disable the device's video streaming capabilities remotely. By sending a specially crafted network request, an attacker can cause the camera to stop responding to legitimate connections. This results in a denial-of-service where the camera can no longer be accessed for monitoring purposes.
Technical details
The Tenda CP3 V3.0 (firmware V31.1.9.91) RTSP parser fails to validate the Content-Length header field during DESCRIBE, SETUP, and PLAY requests. When a request specifies a Content-Length but provides no message body, the parser enters a persistent 'body-awaiting' state. Because the device does not implement a timeout or actively close these stalled connections, it suffers from a TCP resource leak. An unauthenticated remote attacker can exploit this to exhaust available connections, leading to a permanent denial-of-service (DoS) condition for the RTSP service.
Affected products
- Tenda CP3 V3.0 V31.1.9.91
Timeline
- 2026-07-09: disclosed: Initial vulnerability disclosure and CVE assignment.
- 2026-07-09: advisory: NVD published the CVE record.