CVE-2026-6250

Analyzed Analyzed - Analysis Complete

Authenticated Format String Vulnerability in Tapo C110 v2 ONVIF Service

Publication date: 2026-06-11

Last updated on: 2026-06-16

Assigner: TPLink

Description

An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling of user-controlled input. Externally controlled data is interpreted as a format string, which can be used to manipulate stack memory, including control flow data such as return addresses. A remote authenticated attacker may redirect execution flow to existing internal functions, triggering an unauthorized factory reset, leading to loss of configuration, deletion of stored credentials and service disruption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-11

Last Modified

2026-06-16

Generated

2026-07-02

AI Q&A

2026-06-12

EPSS Evaluated

2026-06-30

NVD

CVE-2026-6250

EUVD

EUVD-2026-36326

Affected Vendors & Products

Vendor	Product	Version / Range
tp-link	tapo_c110_firmware	to 1.5.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-134	The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Attack-Flow Graph

Executive Summary

This vulnerability is an authenticated format string flaw in the ONVIF service of the Tapo C110 v2 device. It occurs because the device improperly handles user-controlled input, treating externally controlled data as a format string. This allows an attacker to manipulate stack memory, including critical control flow data such as return addresses.

Impact Analysis

A remote authenticated attacker can exploit this vulnerability to redirect the execution flow of the device to internal functions. This can trigger an unauthorized factory reset, resulting in loss of configuration, deletion of stored credentials, and disruption of the device's service.

Mitigation Strategies

To mitigate the CVE-2026-6250 vulnerability in the Tapo C110 v2 camera, it is recommended to update the device firmware to the latest version, specifically to version 1.5.4 Build 260428 or later.

Applying this firmware update addresses the authenticated format string vulnerability in the ONVIF service that could allow a remote authenticated attacker to trigger an unauthorized factory reset, causing loss of configuration and service disruption.

Compliance Impact

The provided information does not explicitly address how the CVE-2026-6250 vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-6250. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70