CVE-2026-75619
TP-Link
- Published
- 19 August 2026
- Last modified
- 4 September 2026
- CVSS
- 6.9 v4.0
- Severity
- medium
- EPSS
- 0.2% (12th pct)
- CISA KEV
- Not listed
- NVD status
- Analyzed
- Weaknesses
- CWE-122
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Tapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, resulting in out-of-bounds heap writes. Successful exploitation can crash the RTSP service and trigger a device reboot, resulting in a temporary denial-of-service condition.
Exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalogue as of 2026.09.04. That is an absence of confirmed public exploitation, not evidence that exploitation has not occurred. EPSS models a 0.2% probability of exploitation activity in the next 30 days.
Affected products
| Product | Vendor | Type | Versions named |
|---|---|---|---|
| Tapo C100 | TP-Link | unknown | 5.0, < 1.5.4, <= 1.1.15, <= 2020-02-09 |
| Tapo C101 | TP-Link | unknown | 5.0, < 1.5.4 |
References
Vendor advisory and patch
- https://www.tp-link.com/en/support/download/tapo-c100/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/download/tapo-c100/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/download/tapo-c101/#Firmware-Release-Notes
Record assembled from NVD, CISA KEV 2026.09.04 and FIRST EPSS 2026-09-04. Affected products are those NVD's CPE configuration names that fall inside this site's scope; a CVE may affect products outside it.