CVE-2026-104945

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: TPLink

Description

TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive number of preset-related elements, causing writes beyond the bounds of fixed-size stack arrays and resulting in a crash of the affected service. Successful exploitation may allow an authenticated attacker to cause the affected service to crash, resulting in a denial-of-service condition. Repeated exploitation may repeatedly disrupt camera management and PTZ-related functionality until the service recovers or restarts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104945

EUVD

EUVD-2026-93839

Affected Vendors & Products

Vendor	Product	Version / Range
TP-Link	Systems	Inc. Tapo C500 v2.0 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-121	A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

Attack-Flow Graph

Executive Summary

TP-Link Tapo C500 v2.0 has an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can send too many preset-related elements, causing the service to write beyond fixed stack arrays and crash.

Detection Guidance

This vulnerability can be detected by monitoring for crashes in the ONVIF PTZ service of TP-Link Tapo C500 v2.0. Check system logs for service crashes or unusual activity in the ONVIF-related processes. No specific commands are provided in the context.

Impact Analysis

This vulnerability allows an authenticated attacker to crash the affected service, causing a denial-of-service. This disrupts camera management and PTZ functionality until the service restarts.

Compliance Impact

This vulnerability causes a denial-of-service condition by crashing the ONVIF PTZ service, disrupting camera management and PTZ functionality. While it does not directly expose data, repeated disruptions could impair monitoring systems critical for compliance with standards like GDPR or HIPAA, which require continuous data protection and availability.

Mitigation Strategies

Update the TP-Link Tapo C500 v2.0 firmware to the latest version to patch the vulnerability. If an update is not available, restrict ONVIF client access to the device and disable unnecessary PTZ SOAP handlers to reduce attack surface.

Hi! I’m here to help you understand CVE-2026-104945. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70