CVE-2026-51606

An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes the device to abruptly terminate the TCP connection with a RST packet when a request containing an oversized field value is received, without returning any RFC 2326-compliant error response. This behavior affects the request-line URL field and header field values across multiple RTSP request types.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_5th/README.md
https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_5th/README.md

Configurations

No configuration.

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de manejo inadecuado de entradas en el servicio RTSP de Tenda CP3 V3.0 (firmware V31.1.9.91) provoca que el dispositivo termine abruptamente la conexión TCP con un paquete RST cuando se recibe una solicitud que contiene un valor de campo sobredimensionado, sin devolver ninguna respuesta de error conforme a RFC 2326. Este comportamiento afecta el campo URL de la línea de solicitud y los valores de los campos de encabezado en múltiples tipos de solicitudes RTSP.

Information

Published : 2026-07-09 17:17

Updated : 2026-10-25 17:10

NVD link : CVE-2026-51606

Mitre link : CVE-2026-51606

CVE.ORG link : CVE-2026-51606

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2026-51606", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-51606", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T17:50:27.092634Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-07-09T17:17:01.173", "references": [{"url": "https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_5th/README.md", "source": "cve@mitre.org"}, {"url": "https://github.com/kkkk2222874/cve_ID_report/blob/main/Tenda_CP3_V3.0/Tenda_CP3_V3.0_5th/README.md", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes the device to abruptly terminate the TCP connection with a RST packet when a request containing an oversized field value is received, without returning any RFC 2326-compliant error response. This behavior affects the request-line URL field and header field values across multiple RTSP request types."}, {"lang": "es", "value": "Una vulnerabilidad de manejo inadecuado de entradas en el servicio RTSP de Tenda CP3 V3.0 (firmware V31.1.9.91) provoca que el dispositivo termine abruptamente la conexi\u00f3n TCP con un paquete RST cuando se recibe una solicitud que contiene un valor de campo sobredimensionado, sin devolver ninguna respuesta de error conforme a RFC 2326. Este comportamiento afecta el campo URL de la l\u00ednea de solicitud y los valores de los campos de encabezado en m\u00faltiples tipos de solicitudes RTSP."}], "lastModified": "2026-10-25T17:10:00.197", "sourceIdentifier": "cve@mitre.org"}