CVE-2026-19749CWE-287CWE-306

CVE-2026-19749

Low · published August 14, 2026

CVSS v3.1
3.7
EPSS
1%
Percentile
49.4
In the wild
Unconfirmed
What it is

A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability is an unknown functionality of the component RTSP/ONVIF. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is now public and may be used.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00628 · 49.4th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-306 · Missing Authentication for Critical Function
Published
2026-08-14T01:17Z
References (7)
https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20RTSP_ONVIF%20Auth%20Bypass/Tenda%20RTSP_ONVIF%20Auth%20Bypass.md · [email protected]https://vuldb.com/cve/CVE-2026-19749 · [email protected]https://vuldb.com/submit/868503 · [email protected]https://vuldb.com/vuln/389500 · [email protected]https://vuldb.com/vuln/389500/cti · [email protected]https://www.tenda.com.cn/ · [email protected]https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20RTSP_ONVIF%20Auth%20Bypass/Tenda%20RTSP_ONVIF%20Auth%20Bypass.md · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 13 AUG 20:45Z
    Tenda CH7 RTSP/ONVIF missing authentication
    cvelistv5