CVE-2026-75619

MediumCVSS 5.7

Published: 19/08/2026(UTC)Updated: 26/10/2026(UTC)Translated: 20/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.42%

36th percentile - higher than 36% of all known CVEs

Summary

Tapo C100/C101 V5 has a heap-based buffer overflow in the RTSP service. An authenticated attacker on the local network can send crafted RTSP frames with oversized length values, causing out-of-bounds heap writes. Exploitation can crash the RTSP service and reboot the device, leading to temporary denial of service.

Risk Assessment

The risk includes temporary unavailability of the device (camera) due to a local network attack, potentially disrupting surveillance.

Recommendation

Update the firmware to a patched version and restrict local network access to trusted devices.

Other vulnerabilities in Tapo C100/C101

CVE-2026-75618Medium
Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reboot.

Original NVD description (English source)

Tapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, resulting in out-of-bounds heap writes. Successful exploitation can crash the RTSP service and trigger a device reboot, resulting in a temporary denial-of-service condition.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS