TP-Link Tapo C500 CVE-2026-104944

The attacker must have adjacent-network (same LAN / Layer-2 broadcast domain) access to the Tapo C500 v2.0 and be able to reach the UDP port served by the TDP (TP-Link Device Protocol) daemon; per the vendor CVSS vector this is AV:A, so the service is not exploitable from the routed internet by default. Once on-path, no authentication, session establishment, or device pairing is required - a single unauthenticated UDP datagram triggers the out-of-bounds function-pointer dispatch. Limiting factors: exploitation is confined to availability (service crash/DoS only - no data disclosure or code execution per VC:N/VI:N/VA:H), requires local-network adjacency rather than remote reachability, and is specific to the C500 v2.0 running pre-patch firmware.

This is a memory-corruption-induced denial-of-service, not a code-execution flaw: the CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) reports VC:N/VI:N/VA:H, meaning only availability is affected while confidentiality and integrity are untouched. The 7.1 'High' score is driven entirely by the ease of triggering (adjacent network, low complexity, no auth, no user interaction) against a total loss of availability. Crucially the vector is AV:A (adjacent), NOT AV:N (network), so exploitation requires the attacker to be on the same local/Layer-2 segment as the camera rather than reachable across the internet - a significant real-world limiter that the raw score does not surface. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this is a vendor-reported (TP-Link) issue with a patch already available. Although CWE-823 and the 'Memory Corruption' tag could suggest RCE potential, the description and the CVSS impact metrics agree this manifests only as a crash/DoS of the TDP daemon - do not escalate it to a code-execution concern without further vendor detail. Net: a legitimate but bounded issue - patch consumer/edge-network deployments, but it is not an internet-wide, wormable emergency.

An attacker who has gained access to the same local network as the camera (e.g. a compromised Wi-Fi client or a malicious guest on the LAN) sends a single crafted UDP datagram to the Tapo C500's TDP service. The malformed packet triggers an invalid indirect function-pointer call (CWE-823), crashing the main service daemon and taking the camera offline; repeating the packet keeps the device in a persistent denial-of-service state. No public exploit code is identified at time of analysis, and because the CVSS vector is AV:A, the attacker must already have adjacent-network access.