CVE-2026-19749 MEDIUM

CVE-2026-19749: Tenda CH7 RTSP/ONVIF missing authentication

Vendor Tenda
Product CH7
Weakness CWE-306 · Missing auth
Published August 13, 2026
Last update August 18, 2026

CVSS base score

6.3/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality
Integrity

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability is an unknown functionality of the component RTSP/ONVIF. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is now public and may be used.

Key dates

02Disclosure timeline

August 13, 2026 CVE published
August 18, 2026 Record updated

Related vulnerabilities

04Related CVE