CVE-2026-75618

MediumCVSS 6.5

Published: 19/08/2026(UTC)Updated: 26/10/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.38%

31th percentile - higher than 31% of all known CVEs

Summary

Risk Assessment

Successful exploitation can disrupt live video streaming functionality and cause a temporary denial-of-service condition.

Recommendation

Update Tapo device firmware to the latest version and restrict access to the local network.

Other vulnerabilities in Tapo C100/C101

CVE-2026-75619Medium
Tapo C100/C101 V5 has a heap-based buffer overflow in the RTSP service. An authenticated attacker on the local network can send crafted RTSP frames with oversized length values, causing out-of-bounds heap writes. Exploitation can crash the RTSP service and reboot the device, leading to temporary denial of service.

Original NVD description (English source)

Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reboot. Successful exploitation can disrupt live video streaming functionality and cause a temporary denial-of-service condition.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS