CyberRota Analysis
AI-GeneratedThe RTSP service in Tenda CP3 V3.0 firmware is vulnerable to a stack-based buffer overflow due to inadequate validation of URL lengths in a second SETUP request, allowing unauthenticated remote attackers to crash the service. This vulnerability can lead to a denial of service, making the device inaccessible to all clients on the local network. Organizations using this firmware should prioritize patching to mitigate potential disruptions and security risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted second SETUP request. After completing the OPTIONS, DESCRIBE, and a legitimate first SETUP request to obtain a valid session ID, the RTSP service's second-stage URL routing parser fails to validate the length of the URL field in the subsequent SETUP request. By supplying a URL consisting of exactly four consecutive repetitions of a valid RTSP URL, an attacker can bypass first-stage format validation and trigger a stack buffer overflow, causing an immediate crash of the RTSP service process and rendering the device inaccessible to all clients on the local network.