CVE-2026-104945
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive number of preset-related elements, causing writes beyond fixed-size stack arrays and crashing the service.
Risk Assessment
An authenticated attacker can cause the service to crash, resulting in denial of service for camera management and PTZ functionality. Repeated exploitation may persistently disrupt camera operations.
Recommendation
Update TP-Link Tapo C500 v2.0 firmware to the latest version containing the fix. Restrict ONVIF interface access to trusted clients only.
Other vulnerabilities in TP-Link Tapo C500
Original NVD description (English source)
TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive number of preset-related elements, causing writes beyond the bounds of fixed-size stack arrays and resulting in a crash of the affected service. Successful exploitation may allow an authenticated attacker to cause the affected service to crash, resulting in a denial-of-service condition. Repeated exploitation may repeatedly disrupt camera management and PTZ-related functionality until the service recovers or restarts.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS