CVE-2026-15314

Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient input validation before memory copy operations. This may lead to buffer overflow condition, causing the web service process to crash. Successful exploitation may cause the web service process to stop responding or restart, resulting in a denial-of-service condition.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.tp-link.com/en/support/download/tapo-p110/v1/#Firmware-Release-Notes	Release Notes
https://www.tp-link.com/us/support/download/tapo-p110/v1/#Firmware-Release-Notes	Release Notes
https://www.tp-link.com/us/support/faq/5220/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:tp-link:tapo_p110_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:tapo_p110:1.0:*:*:*:*:*:*:*

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El enchufe inteligente Wi-Fi Tapo P110 v1 contiene una vulnerabilidad de validación de límites incorrecta en el manejo de cuerpos de solicitudes HTTP autenticadas debido a una validación de entrada insuficiente antes de las operaciones de copia en memoria. Esto puede llevar a una condición de desbordamiento de búfer, causando que el proceso del servicio web falle. La explotación exitosa puede causar que el proceso del servicio web deje de responder o se reinicie, resultando en una condición de denegación de servicio.

Information

Published : 2026-08-04 17:16

Updated : 2026-10-24 16:10

NVD link : CVE-2026-15314

Mitre link : CVE-2026-15314

CVE.ORG link : CVE-2026-15314

JSON object : View

Products Affected

tp-link

tapo_p110_firmware
tapo_p110

CWE

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

{"id": "CVE-2026-15314", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15314", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-04T17:23:57.677349Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "affectedData": [{"vendor": "TP-Link Systems Inc.", "product": "P110 v1", "versions": [{"status": "affected", "version": "0", "lessThan": "V1_1.1.4 Build 260709", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-04T17:16:46.313", "references": [{"url": "https://www.tp-link.com/en/support/download/tapo-p110/v1/#Firmware-Release-Notes", "tags": ["Release Notes"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/download/tapo-p110/v1/#Firmware-Release-Notes", "tags": ["Release Notes"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/faq/5220/", "tags": ["Vendor Advisory"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "description": [{"lang": "en", "value": "CWE-120"}]}], "descriptions": [{"lang": "en", "value": "Tapo P110 v1\nsmart Wi-Fi Plug contains an improper boundary validation vulnerability in the\nhandling of authenticated HTTP request bodies due to insufficient input\nvalidation before memory copy operations. This may lead to buffer overflow condition,\ncausing the web service process to crash.\n\n\n\n\n\nSuccessful exploitation\nmay cause the web service process to stop responding or restart, resulting in a\ndenial-of-service condition."}, {"lang": "es", "value": "El enchufe inteligente Wi-Fi Tapo P110 v1 contiene una vulnerabilidad de validaci\u00f3n de l\u00edmites incorrecta en el manejo de cuerpos de solicitudes HTTP autenticadas debido a una validaci\u00f3n de entrada insuficiente antes de las operaciones de copia en memoria. Esto puede llevar a una condici\u00f3n de desbordamiento de b\u00fafer, causando que el proceso del servicio web falle.\n\nLa explotaci\u00f3n exitosa puede causar que el proceso del servicio web deje de responder o se reinicie, resultando en una condici\u00f3n de denegaci\u00f3n de servicio."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tapo_p110_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06884333-2087-424B-A682-54EE11E8445C", "versionEndExcluding": "1.1.4"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tapo_p110:1.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1C75945C-1C41-4D93-AC37-A38EDB732882"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630"}