Skip to content
OpenAdvisories
Medium · 6.8 Public exploit CVE-2026-104945 EUVD-2026-93839GHSA-879v-46j6-mx37

Authenticated ONVIF PTZ Out-of-Bounds Stack Write Denial of Service in TP-Link Tapo C500

Published Oct 6, 2026 · Updated Oct 7, 2026 · Assigned by TPLink

Vendor: TP-Link Systems Product: Tapo C500 v2.0 Category: Network devices

Description

TP-Link Tapo
C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ
SOAP handlers. An authenticated ONVIF client can submit an excessive number of
preset-related elements, causing writes beyond the bounds of fixed-size stack
arrays and resulting in a crash of the affected service.

Successful
exploitation may allow an authenticated attacker to cause the affected service
to crash, resulting in a denial-of-service condition. Repeated exploitation may
repeatedly disrupt camera management and PTZ-related functionality until the
service recovers or restarts.

Affected products

VendorProductAffectedFixed
TP-Link Systems Tapo C500 v2.0 < 1.3.5 Build 260810 1.3.5 Build 260810

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References