CVE-2026-104945: Authenticated ONVIF PTZ Out-of-Bounds Stack Write Denial of Service in TP-Link Tapo C500
TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive number of preset-related elements, causing writes beyond the bounds of fixed-size stack arrays and resulting in a crash of the affected service.
Successful exploitation may allow an authenticated attacker to cause the affected service to crash, resulting in a denial-of-service condition. Repeated exploitation may repeatedly disrupt camera management and PTZ-related functionality until the service recovers or restarts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to authenticate as an ONVIF client. The provided information does not indicate that unauthenticated access can trigger the vulnerability.
What functionality is affected if exploitation succeeds?
The affected ONVIF service can crash, disrupting camera management and PTZ-related functions. Repeated requests may sustain disruption until the service recovers or restarts.
What is the immediate mitigation if a firmware update cannot be applied?
Restrict ONVIF access to trusted authenticated clients, since exploitation requires ONVIF authentication. Limiting access to the ONVIF interface reduces the set of users able to submit the malicious preset-related requests.