← Back to CVE Explorer

CVE-2026-75619

Full vulnerability record from the local CVENow database.

Description

Tapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, resulting in out-of-bounds heap writes. Successful exploitation can crash the RTSP service and trigger a device reboot, resulting in a temporary denial-of-service condition.

Severity
MEDIUM
CVSS score
6.9 (v4.0)
Vulnerability status
Analyzed
Source identifier
f23511db-6c3e-4e32-a477-6aa17d310630
Published
2026-08-19 19:17:24.760000
Last modified
2026-10-26 11:10:00.157000
View original CVE JSON 
{
  "id": "CVE-2026-75619",
  "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630",
  "published": "2026-08-19T19:17:24.760",
  "lastModified": "2026-10-26T11:10:00.157",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Tapo\nC100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP\nservice. An authenticated attacker on the local network can send specially\ncrafted RTSP frame data containing oversized length values, resulting in\nout-of-bounds heap writes. \n\n\n\n\n\nSuccessful\nexploitation can crash the RTSP service and trigger a device reboot, resulting\nin a temporary denial-of-service condition."
    },
    {
      "lang": "es",
      "value": "Tapo C100/C101 V5 contiene una vulnerabilidad de desbordamiento de búfer basado en montículo en el servicio RTSP. Un atacante autenticado en la red local puede enviar datos de trama RTSP especialmente diseñados que contienen valores de longitud excesivos, lo que resulta en escrituras fuera de límites en el montículo.\n\nLa explotación exitosa puede bloquear el servicio RTSP y desencadenar un reinicio del dispositivo, lo que resulta en una condición temporal de denegación de servicio."
    }
  ],
  "affected": [
    {
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "affectedData": [
        {
          "vendor": "TP-Link Systems Inc.",
          "product": "Tapo C100 v5",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.5.4 Build 260528 Rel.11462n",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "TP-Link Systems Inc.",
          "product": "Tapo C101 v5",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.5.4 Build 260528 Rel.11462n",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.7,
          "baseSeverity": "MEDIUM",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-19T19:31:18.255651Z",
          "id": "CVE-2026-75619",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-122"
        }
      ]
    }
  ],
  "configurations": [
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:tp-link:tapo_c100_firmware:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.5.4",
              "matchCriteriaId": "EDB93E03-381A-4993-8244-4335BC3ABAF4"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:tp-link:tapo_c100:5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD02A17C-9039-4376-867F-F8F300B94B48"
            }
          ]
        }
      ]
    },
    {
      "operator": "AND",
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:tp-link:tapo_c101_firmware:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "1.5.4",
              "matchCriteriaId": "53291739-C959-4491-852C-5821D83A8D46"
            }
          ]
        },
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": false,
              "criteria": "cpe:2.3:h:tp-link:tapo_c101:5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "4AA495B0-AF30-4677-B8E7-842B13C3D0EA"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.tp-link.com/en/support/download/tapo-c100/#Firmware-Release-Notes",
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://www.tp-link.com/us/support/download/tapo-c100/#Firmware-Release-Notes",
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://www.tp-link.com/us/support/download/tapo-c101/#Firmware-Release-Notes",
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "tags": [
        "Product",
        "Release Notes"
      ]
    },
    {
      "url": "https://www.tp-link.com/us/support/faq/5251/",
      "source": "f23511db-6c3e-4e32-a477-6aa17d310630",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}