Login Request a demo
Low severity · published Aug 13, 2026
CVE-2026-19749
Tenda CH7 RTSP/ONVIF missing authentication
3.7
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability was detected in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. Affected by this vulnerability is an unknown functionality of the component RTSP/ONVIF. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit is now public and may be used.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
CH10 · Tenda
20260625 · source: vendor
CH
CH7 · Tenda
20260625 · source: vendor
CH
CH7G · Tenda
20260625 · source: vendor
CP
CP3 · Tenda
20260625 · source: vendor
CP
CP3 Pro · Tenda
20260625 · source: vendor
CP
CP7 · Tenda
20260625 · source: vendor
TC
TC3B14C · Tenda
20260625 · source: vendor
TC
TC3B15C · Tenda
20260625 · source: vendor
TC
TC3T14C · Tenda
20260625 · source: vendor
TC
TC3T15C · Tenda
20260625 · source: vendor
Affected product
CH
CH10
Tenda
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19749
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19749
github.com
https://github.com/howitouchyou/Tenda-Smart-Camera-Vulnerability/blob/main/Tenda%20RTSP_ONVIF%20Auth%20Bypass/Tenda%20RTSP_ONVIF%20Auth%20Bypass.md
vuldb.com
https://vuldb.com/cve/CVE-2026-19749
vuldb.com
https://vuldb.com/submit/868503
vuldb.com
https://vuldb.com/vuln/389500
vuldb.com
https://vuldb.com/vuln/389500/cti
www.tenda.com.cn
https://www.tenda.com.cn/
More from CH10
9.8
CVE-2026-19747
Tenda CH7 ATE Module Kylin HandleCmd command injection
3.7
CVE-2026-19748
Tenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropy