CVE-2026-104944— Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500
Quick assessment
Affected
TP-Link Systems Inc. Tapo C500 v2.0
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
TP-Link Tapo C500（固件版本 v2.0）的 TDP（TP-Link 设备协议）守护进程中存在一个越界函数指针分派漏洞。攻击者只需发送一个未经身份验证的 UDP 数据报，即可引发无效的间接函数调用，导致主服务崩溃，从而造成拒绝服务（DoS）状况。 成功利用该漏洞可使具备网络访问权限且无需身份验证的攻击者反复崩溃 TDP 守护进程，破坏设备的正常运行和可用性。触发此漏洞无需任何身份验证、会话建立或配队（pairing）操作。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| TP-Link Systems Inc. | Tapo C500 v2.0 | < 1.3.5 Build 260810 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-104944
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500
Source: CVE Program / CVE List V5
Vulnerability Description
TP-Link Tapo
C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP
(TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can
cause an invalid indirect call, crashing the main service and resulting in a
denial-of-service condition.
Successful
exploitation may allow an unauthenticated attacker with network access to the
affected UDP service to repeatedly crash the TDP daemon, disrupting normal
device operation and availability. No authentication, session establishment, or
pairing is required to trigger the condition.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用越界的指针偏移
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| TP-Link Systems Inc. | Tapo C500 v2.0 | 0 ~ 1.3.5 Build 260810 | - |
|
II. Public POCs for CVE-2026-104944
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-104944
请登录查看更多情报信息。
Other References for CVE-2026-104944 (3)
-
https://www.tp-link.com/us/support/faq/5327/ vendor-advisory
IV. Related Vulnerabilities
Same vendor: TP-Link Systems Inc.
-
CVE-2026-104945
Authenticated ONVIF PTZ Out-of-Bounds Stack Write Denial of -
CVE-2026-102370
Physical UART Access Leading to an Unauthenticated Root Shel -
CVE-2026-84682
TDDPv2 setProductVer Command Injection in Archer AX90 -
CVE-2026-8618
Pre-Authentication Stack-based Buffer Overflow Remote Code E -
CVE-2026-102369
Unauthenticated Remote Code Execution via MacTool Command In
Same weakness: CWE-823
-
CVE-2026-45199
GPU DDK - rgxfw_to_ptr() does not reject FW private data poi -
CVE-2026-72642
Use of Out-of-range Pointer Offset in the Elasticsearch Mach -
CVE-2026-49746
GPU DDK - Dimension Mismatch and Integer Truncation in PMRDe -
CVE-2026-49745
GPU DDK - Unvalidated sHWPerfCtlDMABuf GPU-VA, DMA-write int -
CVE-2026-49744
GPU DDK - Unchecked ui32TracePointer in rgxfw_log_ex()
V. Comments for CVE-2026-104944
No comments yet