Tenda CP3 V3.0 routers running firmware V31.1.9.91 do not validate the Content-Length header in RTSP requests such as DESCRIBE, SETUP, and PLAY. When a request includes this header but carries no message body, the RTSP parser enters a persistent body‑awaiting state, leaving the TCP connection permanently non‑functional and leaking socket resources. This flaw represents uncontrolled resource consumption (CWE‑400) and a failure to terminate the connection (CWE‑703), allowing an attacker to force a denial‑of‑service condition.

Only the Tenda CP3 V3.0 router with firmware revision V31.1.9.91 is affected; no other vendors, products, or firmware versions are listed in the CVE record.

The vulnerability carries a CVSS score of 7.5, indicating high severity. Its EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild, and it is not included in the CISA KEV catalog. The attack vector is remote and unauthenticated, relying on standard RTSP traffic; an attacker can send a crafted RTSP request carrying a Content-Length header but no body to exhaust the router’s TCP connection pool and render the RTSP service permanently unusable.