CVE-2026-1871

MediumCVSS 6.5

Published: 02/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

23th percentile - higher than 23% of all known CVEs

Summary

TP-Link Tapo C200 v5 has a stack-based buffer overflow in RTSP authentication handling due to improper validation of Authorization header lengths. A crafted request crashes the RTSP service and triggers a system reboot, causing denial of service.

Risk Assessment

An attacker can remotely disable the camera, blocking access to the video stream and management interface until reboot.

Recommendation

Apply a firmware update from the vendor when available, or restrict access to the RTSP port.

Other vulnerabilities in TP-Link Tapo C200

CVE-2023-27126Medium
In the TP-Link TAPO C200 V3 (EU) camera with firmware 1.1.22 Build 220725, the AES Key-IV pair is shared across all devices. An attacker with physical access to the camera can extract and decrypt sensitive data, including the WiFi password and TP-Link account credentials of the victim.

Original NVD description (English source)

TP-Link Tapo C200 v5 contains a stack-based buffer overflow flaw in RTSP authentication handling due to improper validation of Authorization header field lengths, which can be triggered by a crafted authentication request. Successful exploitation causes the affected RTSP core service process to crash and triggers an automatic system reboot, resulting in a denial of service (DoS) condition. This prevents legitimate users from accessing the camera’s live video stream or management interface until the service restarts.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS