CVE-2026-75619
MediumCVSS 6.9Summary
Tapo C100/C101 V5 has a heap-based buffer overflow in the RTSP service. An authenticated attacker on the local network can send crafted RTSP frames with oversized length values, causing out-of-bounds heap writes. Exploitation can crash the RTSP service and reboot the device, leading to temporary denial of service.
Risk Assessment
The risk includes temporary unavailability of the device (camera) due to a local network attack, potentially disrupting surveillance.
Recommendation
Update the firmware to a patched version and restrict local network access to trusted devices.
Original NVD description (English source)
Tapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, resulting in out-of-bounds heap writes. Successful exploitation can crash the RTSP service and trigger a device reboot, resulting in a temporary denial-of-service condition.