TP-Link Tapo
C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ
SOAP handlers. An authenticated ONVIF client can submit an excessive number of
preset-related elements, causing writes beyond the bounds of fixed-size stack
arrays and resulting in a crash of the affected service.
Successful
exploitation may allow an authenticated attacker to cause the affected service
to crash, resulting in a denial-of-service condition. Repeated exploitation may
repeatedly disrupt camera management and PTZ-related functionality until the
service recovers or restarts.
C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ
SOAP handlers. An authenticated ONVIF client can submit an excessive number of
preset-related elements, causing writes beyond the bounds of fixed-size stack
arrays and resulting in a crash of the affected service.
Successful
exploitation may allow an authenticated attacker to cause the affected service
to crash, resulting in a denial-of-service condition. Repeated exploitation may
repeatedly disrupt camera management and PTZ-related functionality until the
service recovers or restarts.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 06 Oct 2026 19:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive number of preset-related elements, causing writes beyond the bounds of fixed-size stack arrays and resulting in a crash of the affected service. Successful exploitation may allow an authenticated attacker to cause the affected service to crash, resulting in a denial-of-service condition. Repeated exploitation may repeatedly disrupt camera management and PTZ-related functionality until the service recovers or restarts. | |
| Title | Authenticated ONVIF PTZ Out-of-Bounds Stack Write Denial of Service in TP-Link Tapo C500 | |
| Weaknesses | CWE-121 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: TPLink
Published:
Updated: 2026-10-06T18:41:13.133Z
Reserved: 2026-10-02T17:39:51.763Z
Link: CVE-2026-104945
Vulnrichment
No data.
NVD
Status : Deferred
Published: 2026-10-06T19:17:40.840
Modified: 2026-10-06T20:03:53.457
Link: CVE-2026-104945
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses