CVE-2026-105810: Authenticated Local Stack Overflow in TP-Link Tapo C320WS
Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path. An authenticated attacker on the adjacent network can submit a crafted request containing an oversized encrypted password field, overwrite stack state, and execute commands with root privileges.
Successful exploitation may allow an authenticated adjacent-network attacker to take control of the affected camera, modify camera behavior, access sensitive local configuration, and disrupt device availability.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and on an adjacent network to the affected camera. The vulnerable path is the local onboarding Wi-Fi configuration function.
What level of access could successful exploitation provide?
Successful exploitation can allow execution of commands with root privileges on the camera. This could enable takeover of the device, modification of its behavior, access to sensitive local configuration, and disruption of availability.
What does an attacker need to send to trigger the overflow?
The attacker submits a crafted request with an oversized encrypted password field through the local onboarding Wi-Fi configuration path.