Tapo C500 CVE-2026-104945

Exploitation requires the attacker to be an authenticated ONVIF client (PR:H) with network reachability to the camera's ONVIF PTZ SOAP service on the adjacent/local network (AV:A), and the ONVIF/PTZ interface must be enabled and accessible. The specific trigger is submitting an excessive number of preset-related elements to the PTZ SOAP handlers, overflowing fixed-size stack arrays. Limiting factors: valid ONVIF credentials are mandatory (no unauthenticated path), the camera is not exposed to the internet by default so an adjacent-network foothold is needed, and the realistic outcome is limited to a recoverable service crash/DoS rather than code execution or data exposure.

This is a genuine but low-to-moderate priority issue whose signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:H/UI:N, VA:H with VC:N/VI:N) describes an adjacent-network, low-complexity attack that requires HIGH privileges (PR:H - an already-authenticated ONVIF client) and yields only an availability impact (denial of service), which aligns precisely with the description of a stack out-of-bounds write that crashes the ONVIF PTZ service. The 6.8 (Medium) score is driven entirely by availability loss; there is no confidentiality or integrity impact and no code-execution claim despite CWE-121 (stack-based buffer overflow) - the vendor characterizes the outcome strictly as a crash/DoS, not RCE. No EPSS score, KEV listing, or public POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; absence of these is expected for a newly disclosed consumer-device DoS. Two caveats for defenders: (1) PR:H plus AV:A means the attacker must already be an authenticated ONVIF user on the local/adjacent network, sharply limiting real-world risk to insiders or already-compromised LAN footholds; (2) a stack out-of-bounds write (CWE-121) can sometimes be escalated beyond a crash, but the vendor explicitly limits impact to DoS, so any RCE potential is unverified and should not be assumed.

An attacker with valid ONVIF credentials on the same local network as the Tapo C500 camera connects to the ONVIF PTZ SOAP endpoint and sends a crafted request containing an excessive number of preset-related elements. The oversized input overflows a fixed-size stack array in the PTZ handler, corrupting the stack and crashing the ONVIF service, disrupting camera management and PTZ control. No public exploit code is identified at time of analysis; exploitation requires prior authentication and adjacent-network access.