CVE-2026-75619— RTSP Heap Buffer Overflow Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101
Quick assessment
Affected
TP-Link Systems Inc. Tapo C100 v5
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Tapo C100/C101 V5 的 RTSP 服务中存在一个基于堆的缓冲区溢出漏洞。位于本地网络中的已认证攻击者可以发送包含超大长度值的专业构造的 RTSP 帧数据，导致对堆内存的越界写入。 成功利用该漏洞可导致 RTSP 服务崩溃并触发设备重启，从而造成暂时性的拒绝服务（DoS）状态。
Affected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| TP-Link Systems Inc. | Tapo C100 v5 | < 1.5.4 Build 260528 Rel.11462n |
affected |
| TP-Link Systems Inc. | Tapo C101 v5 | < 1.5.4 Build 260528 Rel.11462n |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-75619
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RTSP Heap Buffer Overflow Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101
Source: CVE Program / CVE List V5
Vulnerability Description
Tapo
C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP
service. An authenticated attacker on the local network can send specially
crafted RTSP frame data containing oversized length values, resulting in
out-of-bounds heap writes.
Successful
exploitation can crash the RTSP service and trigger a device reboot, resulting
in a temporary denial-of-service condition.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
堆缓冲区溢出
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| TP-Link Systems Inc. | Tapo C100 v5 | 0 ~ 1.5.4 Build 260528 Rel.11462n | - |
|
| TP-Link Systems Inc. | Tapo C101 v5 | 0 ~ 1.5.4 Build 260528 Rel.11462n | - |
|
II. Public POCs for CVE-2026-75619
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-75619
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-75619 (1)
Vendor Pages for CVE-2026-75619 (2)
Same Patch Batch · TP-Link Systems Inc. · 2026-08-19 · 4 CVEs total
| CVE-2026-75616 | 8.5 HIGH | Command Injection in Router Web Management Interface |
| CVE-2026-75618 | 7.1 HIGH | RTSP Null Pointer Dereference Denial-of-Service Vulnerability on TP-Link Tapo C100 and C10 |
| CVE-2026-8619 | 7.1 HIGH | Unauthenticated Denial-of-Service Vulnerability in HTTP Service in TP-Link TL-MR100, TL-MR |
IV. Related Vulnerabilities
Same vendor: TP-Link Systems Inc.
-
CVE-2026-78541
Command Injection in Parent Control of TP-Link Archer BE3600 -
CVE-2026-16348
Command Injection Vulnerability in VPN connection of Archer -
CVE-2026-9254
Command Injection Vulnerability in Parent Control of Multipl -
CVE-2026-15469
Hard-coded Mesh Group Private Key in TP-Link Deco XE75, XE53 -
CVE-2026-17252
Unauthenticated Denial of Service via Composed HTTP Parsing
Same weakness: CWE-122
-
CVE-2026-78156
Open5GS S6a Authentication-Information-Request hss-s6a-path. -
CVE-2026-62381
luci-lib-px5g 2040-bit Certificate Signing Heap Buffer Overf -
CVE-2026-50538
libvncclient Tight decoder has an attacker-controlled heap o -
CVE-2026-55893
Capstone SH disassembler `set_reg_n` heap buffer overflow vi -
CVE-2026-70654
libvips: A well-crafted PPM image processed via a custom sou
V. Comments for CVE-2026-75619
No comments yet