Firmware V31.1.9.91 on the Tenda CP3 V3.0 router does not validate the Content-Length header in RTSP requests such as DESCRIBE, SETUP and PLAY. When a request contains a Content-Length header but no message body, the RTSP parser enters a persistent body‑awaiting state and remains stuck, exhausting TCP socket resources. This omission is a classic uncontrolled resource consumption flaw (CWE-400 the parser from aborting the connection (CWE-703). An unauthenticated attacker can send, causing a denial‑of‑service because the router's RTSP service becomes permanently non‑functional and the device eventually exhausts its available TCP connections.

The vulnerability is limited to the Tenda CP3 V3.0 router running firmware V31.1.9.91. No other vendors, products, or firmware versions are affected according to the CVE record.

The vulnerability carries a CVSS score of 7.5, indicating high severity. Its EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild, and it is not catalogued in the CISA KEV list. However, the attack vector is remote, unauthenticated, and based on standard RTSP traffic. An attacker can exploit the lack of Content‑Length validation to exhaust the device’s TCP connection pool, effectively disrupting network services and rendering the RTSP functionality unusable.