CVE-2026-19749

Tenda CH7 RTSP/ONVIF missing authentication

State: Published
Severity: 6.3 Medium
Published: Aug 13, 2026
Updated: Aug 18, 2026
Reserved: Aug 13, 2026

Description

A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability is an unknown functionality of the component RTSP/ONVIF. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is now public and may be used.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P	VulDB
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R	VulDB
3.0	3.7 Low	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:W/RC:R	VulDB
2.0	2.6 Low	AV:N/AC:H/Au:N/C:P/I:N/A:N/E:POC/RL:W/RC:UR	VulDB

Weaknesses

CWE-306 Missing Authentication
CWE-287 Improper Authentication

Affected Products

Product	Versions
CH7Tenda	20260625Affected
CH7GTenda	20260625Affected
CH10Tenda	20260625Affected
CP3Tenda	20260625Affected
CP3 ProTenda	20260625Affected
CP7Tenda	20260625Affected
TC3B14CTenda	20260625Affected
TC3B15CTenda	20260625Affected
TC3T14CTenda	20260625Affected
TC3T15CTenda	20260625Affected

References

VDB-389500 | Tenda CH7 RTSP/ONVIF missing authenticationvdb-entry
VDB-389500 | CTI Indicators (IOB, IOC)signaturepermissions-required
CVE-2026-19749 | CVE Analysis and Reportthird-party-advisory
Submit #868503 | Tenda Tenda Multiple IP Cameras Multiple Versions Missing Authenticationthird-party-advisory
https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20RTSP_ONVIF%20Auth%20Bypass/Tenda%20RTSP_ONVIF%20Auth%20Bypass.mdrelated
https://www.tenda.com.cn/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.