CVE-2026-75619

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-75619", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "state": "PUBLISHED", "assignerShortName": "TPLink", "dateReserved": "2026-08-18T00:01:50.160Z", "datePublished": "2026-08-19T18:30:59.192Z", "dateUpdated": "2026-08-27T23:12:28.065Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-08-27T23:12:28.065Z"}, "title": "RTSP Heap Buffer Overflow Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-122", "description": "CWE-122 Heap-based buffer overflow", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "Tapo C100 v5", "versions": [{"status": "affected", "version": "0", "lessThan": "1.5.4 Build 260528 Rel.11462n", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Tapo C101 v5", "versions": [{"status": "affected", "version": "0", "lessThan": "1.5.4 Build 260528 Rel.11462n", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Tapo\nC100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP\nservice. An authenticated attacker on the local network can send specially\ncrafted RTSP frame data containing oversized length values, resulting in\nout-of-bounds heap writes. \n\n\n\n\n\nSuccessful\nexploitation can crash the RTSP service and trigger a device reboot, resulting\nin a temporary denial-of-service condition.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Tapo\nC100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP\nservice. An authenticated attacker on the local network can send specially\ncrafted RTSP frame data containing oversized length values, resulting in\nout-of-bounds heap writes. </p>\n\n<p>Successful\nexploitation can crash the RTSP service and trigger a device reboot, resulting\nin a temporary denial-of-service condition.</p>"}]}], "references": [{"url": "https://www.tp-link.com/us/support/download/tapo-c100/#Firmware-Release-Notes", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/download/tapo-c101/#Firmware-Release-Notes", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/faq/5251/", "tags": ["vendor-advisory"]}, {"url": "https://www.tp-link.com/en/support/download/tapo-c100/#Firmware-Release-Notes", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Cooper Young (https://coopergyoung.com)", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-19T19:31:18.255651Z", "id": "CVE-2026-75619", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T19:31:44.015Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-75619", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T19:31:18.255651Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T19:31:24.416Z"}}], "cna": {"title": "RTSP Heap Buffer Overflow Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Cooper Young (https://coopergyoung.com)"}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "Tapo C100 v5", "versions": [{"status": "affected", "version": "0", "lessThan": "1.5.4 Build 260528 Rel.11462n", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Tapo C101 v5", "versions": [{"status": "affected", "version": "0", "lessThan": "1.5.4 Build 260528 Rel.11462n", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.tp-link.com/us/support/download/tapo-c100/#Firmware-Release-Notes", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/download/tapo-c101/#Firmware-Release-Notes", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/faq/5251/", "tags": ["vendor-advisory"]}, {"url": "https://www.tp-link.com/en/support/download/tapo-c100/#Firmware-Release-Notes", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "Tapo\nC100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP\nservice. An authenticated attacker on the local network can send specially\ncrafted RTSP frame data containing oversized length values, resulting in\nout-of-bounds heap writes. \n\n\n\n\n\nSuccessful\nexploitation can crash the RTSP service and trigger a device reboot, resulting\nin a temporary denial-of-service condition.", "supportingMedia": [{"type": "text/html", "value": "<p>Tapo\nC100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP\nservice. An authenticated attacker on the local network can send specially\ncrafted RTSP frame data containing oversized length values, resulting in\nout-of-bounds heap writes. </p>\n\n<p>Successful\nexploitation can crash the RTSP service and trigger a device reboot, resulting\nin a temporary denial-of-service condition.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based buffer overflow"}]}], "providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-08-27T23:12:28.065Z"}}}, "cveMetadata": {"cveId": "CVE-2026-75619", "state": "PUBLISHED", "dateUpdated": "2026-08-27T23:12:28.065Z", "dateReserved": "2026-08-18T00:01:50.160Z", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "datePublished": "2026-08-19T18:30:59.192Z", "assignerShortName": "TPLink"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Tapo C100 v5", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "1.5.4 Build 260528 Rel.11462n", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Tapo C101 v5", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "1.5.4 Build 260528 Rel.11462n", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tapo_c100_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "EDB93E03-381A-4993-8244-4335BC3ABAF4", "versionEndExcluding": "1.5.4", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tapo_c100:5.0:*:*:*:*:*:*:*", "matchCriteriaId": "CD02A17C-9039-4376-867F-F8F300B94B48", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tapo_c101_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "53291739-C959-4491-852C-5821D83A8D46", "versionEndExcluding": "1.5.4", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tapo_c101:5.0:*:*:*:*:*:*:*", "matchCriteriaId": "4AA495B0-AF30-4677-B8E7-842B13C3D0EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tapo\nC100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP\nservice. An authenticated attacker on the local network can send specially\ncrafted RTSP frame data containing oversized length values, resulting in\nout-of-bounds heap writes. \n\n\n\n\n\nSuccessful\nexploitation can crash the RTSP service and trigger a device reboot, resulting\nin a temporary denial-of-service condition."}, {"lang": "es", "value": "Tapo C100/C101 V5 contiene una vulnerabilidad de desbordamiento de b\u00fafer basado en mont\u00edculo en el servicio RTSP. Un atacante autenticado en la red local puede enviar datos de trama RTSP especialmente dise\u00f1ados que contienen valores de longitud excesivos, lo que resulta en escrituras fuera de l\u00edmites en el mont\u00edculo.\n\nLa explotaci\u00f3n exitosa puede bloquear el servicio RTSP y desencadenar un reinicio del dispositivo, lo que resulta en una condici\u00f3n temporal de denegaci\u00f3n de servicio."}], "id": "CVE-2026-75619", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75619", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-19T19:31:18.255651Z", "version": "2.0.3"}}]}, "published": "2026-08-19T19:17:24.760", "references": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Product", "Release Notes"], "url": "https://www.tp-link.com/en/support/download/tapo-c100/#Firmware-Release-Notes"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Product", "Release Notes"], "url": "https://www.tp-link.com/us/support/download/tapo-c100/#Firmware-Release-Notes"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Product", "Release Notes"], "url": "https://www.tp-link.com/us/support/download/tapo-c101/#Firmware-Release-Notes"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "tags": ["Vendor Advisory"], "url": "https://www.tp-link.com/us/support/faq/5251/"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.5.4 Build 260528 Rel.11462n)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Tapo C100 v5", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "tapo_c100_v5", "vendor": "tp-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.5.4 Build 260528 Rel.11462n)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Tapo C101 v5", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "tapo_c101_v5", "vendor": "tp-link"}], "created": "2026-08-20T00:00:06.574697+00:00", "updated": "2026-08-20T12:45:03.562150+00:00", "vendors": ["tp-link", "tp-link$PRODUCT$tapo_c100_v5", "tp-link$PRODUCT$tapo_c101_v5"]}