CVE-2026-75619

Tapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, resulting in out-of-bounds heap writes. Successful exploitation can crash the RTSP service and trigger a device reboot, resulting in a temporary denial-of-service condition.

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.tp-link.com/en/support/download/tapo-c100/#Firmware-Release-Notes	Product Release Notes
https://www.tp-link.com/us/support/download/tapo-c100/#Firmware-Release-Notes	Product Release Notes
https://www.tp-link.com/us/support/download/tapo-c101/#Firmware-Release-Notes	Product Release Notes
https://www.tp-link.com/us/support/faq/5251/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:tp-link:tapo_c100_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:tapo_c100:5.0:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:tp-link:tapo_c101_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:tapo_c101:5.0:*:*:*:*:*:*:*

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Tapo C100/C101 V5 contiene una vulnerabilidad de desbordamiento de búfer basado en montículo en el servicio RTSP. Un atacante autenticado en la red local puede enviar datos de trama RTSP especialmente diseñados que contienen valores de longitud excesivos, lo que resulta en escrituras fuera de límites en el montículo. La explotación exitosa puede bloquear el servicio RTSP y desencadenar un reinicio del dispositivo, lo que resulta en una condición temporal de denegación de servicio.

Information

Published : 2026-08-19 19:17

Updated : 2026-10-26 11:10

NVD link : CVE-2026-75619

Mitre link : CVE-2026-75619

CVE.ORG link : CVE-2026-75619

JSON object : View

Products Affected

tp-link

tapo_c100_firmware
tapo_c100
tapo_c101
tapo_c101_firmware

CWE

CWE-122

Heap-based Buffer Overflow

{"id": "CVE-2026-75619", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75619", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T19:31:18.255651Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.1}], "cvssMetricV40": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "affectedData": [{"vendor": "TP-Link Systems Inc.", "product": "Tapo C100 v5", "versions": [{"status": "affected", "version": "0", "lessThan": "1.5.4 Build 260528 Rel.11462n", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Tapo C101 v5", "versions": [{"status": "affected", "version": "0", "lessThan": "1.5.4 Build 260528 Rel.11462n", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-19T19:17:24.760", "references": [{"url": "https://www.tp-link.com/en/support/download/tapo-c100/#Firmware-Release-Notes", "tags": ["Product", "Release Notes"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/download/tapo-c100/#Firmware-Release-Notes", "tags": ["Product", "Release Notes"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/download/tapo-c101/#Firmware-Release-Notes", "tags": ["Product", "Release Notes"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/faq/5251/", "tags": ["Vendor Advisory"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "Tapo\nC100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP\nservice. An authenticated attacker on the local network can send specially\ncrafted RTSP frame data containing oversized length values, resulting in\nout-of-bounds heap writes. \n\n\n\n\n\nSuccessful\nexploitation can crash the RTSP service and trigger a device reboot, resulting\nin a temporary denial-of-service condition."}, {"lang": "es", "value": "Tapo C100/C101 V5 contiene una vulnerabilidad de desbordamiento de b\u00fafer basado en mont\u00edculo en el servicio RTSP. Un atacante autenticado en la red local puede enviar datos de trama RTSP especialmente dise\u00f1ados que contienen valores de longitud excesivos, lo que resulta en escrituras fuera de l\u00edmites en el mont\u00edculo.\n\nLa explotaci\u00f3n exitosa puede bloquear el servicio RTSP y desencadenar un reinicio del dispositivo, lo que resulta en una condici\u00f3n temporal de denegaci\u00f3n de servicio."}], "lastModified": "2026-10-26T11:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tapo_c100_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EDB93E03-381A-4993-8244-4335BC3ABAF4", "versionEndExcluding": "1.5.4"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tapo_c100:5.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CD02A17C-9039-4376-867F-F8F300B94B48"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tapo_c101_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53291739-C959-4491-852C-5821D83A8D46", "versionEndExcluding": "1.5.4"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tapo_c101:5.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4AA495B0-AF30-4677-B8E7-842B13C3D0EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630"}