CVE-2026-75619: RTSP Heap Buffer Overflow Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101
Tapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, resulting in out-of-bounds heap writes.
Successful exploitation can crash the RTSP service and trigger a device reboot, resulting in a temporary denial-of-service condition.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects TP-Link Tapo C100 and C101 hardware version V5 devices with the RTSP service in use. Exploitation is limited to an attacker on the local network.
What access does an attacker need to trigger the denial of service?
The attacker must be authenticated and able to reach the device over the local network. They must send specially crafted RTSP frame data with oversized length values.
What is the expected impact of successful exploitation?
Successful exploitation can cause out-of-bounds heap writes that crash the RTSP service and reboot the device. This produces a temporary denial-of-service condition.