Tenda Smart Cameras RTSP and ONVIF Authentication Bypass via Simplified Chinese Config

Tenda Smart Cameras Default RTSP and ONVIF Authentication Bypass Vulnerability Overview Tenda smart camera firmware utilizes the ZhiLing/Kylin OEM solution, including the following verified product series and versions: CH Series: CH10: V26.4.41.36, CH7: V26.5.59.2, CH7G: V26.5.60.2 CP Series: CP3: V22.5.4.110, V27.5.52.11, V27.5.52.17, V27.5.57.17, CP3 Pro: V21.7.17.111, CP7: V26.5.45.17 TC3 Series: TC3B14C: V25.4.25.53, V25.4.42.20, V25.4.42.21, TC3B15C: V25.4.26.52, V25.4.26.53, TC3T14C: V25.4.43.20, TC3T15C: V25.4.43.21 Potential affected scope: Tenda smart camera firmware versions using the same ZhiLing/Kylin OEM architecture, unless the vendor has redesigned the underlying Kylin/ATE modules after November 2025. Vulnerability Type: Missing Authentication / Insecure Default Configuration Vulnerability Description: A missing authentication vulnerability exists in certain Tenda smart camera firmwares. When the device is configured for Simplified Chinese, the firmware disables RTSP authentication and ONVIF authentication. Consequently, an attacker with network accessibility can access the camera video stream via RTSP without valid credentials. The attacker can also access ONVIF functionalities, such as device management and PTZ control, without authentication. Vulnerability Details: In the affected firmware used in the Kylin main program, the default configuration logic checks whether the language is set to "zhongSimplifiedChinese". If this condition is met, the firmware sets and to 0, meaning RTSP and ONVIF authentication are disabled by default. For other language configurations, these security options are set to 1. This language-dependent insecure default configuration exposes the device's RTSP and ONVIF services to unauthenticated access in Simplified Chinese environments. An attacker only needs network access to the device to exploit this issue. No valid account, password, session token, or prior authentication is required. Affected Scope CH Series: CH10: V26.4.41.36, CH7: V26.5.59.2, CH7G: V26.5.60.2 CP Series: CP3: V22.5.4.110, V27.5.52.11, V27.5.52.17, V27.5.57.17, CP3 Pro: V21.7.17.111, CP7: V26.5.45.17 TC3 Series: TC3B14C: V25.4.25.53, V25.4.42.20, V25.4.42.21, TC3B15C: V25.4.26.52, V25.4.26.53, TC3T14C: V25.4.43.20, TC3T15C: V25.4.43.21 Workarounds Reset or initialize the affected Tenda smart cameras, using the default Simplified Chinese configuration. Confirm that RTSP authentication and ONVIF authentication are disabled by default. Access the RTSP service from a network-reachable host without providing valid credentials. Obtain real-time video streams without authentication. Use an ONVIF-compatible client without valid credentials. Discover and manage the device and supported ONVIF functionalities, such as ODM control. Expected Result: RTSP and ONVIF access should require valid authentication. Actual Result: Under the affected default configuration, RTSP and ONVIF services can be accessed without authentication. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

Tenda Smart Cameras RTSP and ONVIF Authentication Bypass via Simplified Chinese Config

More from this source