EUVD-2026-95404
GHSA-mjqg-3r8q-j4cx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain adjacent-network foothold (same LAN/Wi-Fi)
-
DeliveryConnect to RTSP service on TCP 554
-
ExploitSend crafted RTSP-over-HTTP tunneling request pair
-
ExecutionTrigger stack buffer overflow in streaming daemon
-
ImpactCrash service, disrupt live video stream
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the optional 'Camera Account' feature to be ENABLED on the Tapo C325WB v2; without it the vulnerable RTSP path is not exposed. The attacker must reach the RTSP streaming service on TCP port 554 and must be on an ADJACENT network (AV:A) - i.e., the same local/Wi-Fi segment as the camera, not the public internet - which limits exploitation to LAN-positioned attackers (compromised local host, rogue device, or shared Wi-Fi). No authentication is required (PR:N) and no user interaction is needed (UI:N). Impact is limited to denial of service of streaming functions; the service recovers or restarts afterward, so the disruption is temporary rather than persistent. |
| Impact | This is a moderate, availability-only issue rather than a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) correctly reflects an unauthenticated attack with low complexity but an ADJACENT (not internet-routable) network requirement and impact limited purely to availability (VA:H; no confidentiality or integrity loss). The 7.1 score is driven entirely by the availability impact and ease of triggering, not by any code-execution or data-exposure risk, so despite CWE-121 (stack-based buffer overflow) there is no evidence this goes beyond a daemon crash/DoS. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence set - exploitation status is therefore 'no public exploit identified at time of analysis.' The adjacency constraint (attacker must be on the same L2/local network as the camera) and the requirement that the optional 'Camera Account' feature be enabled meaningfully narrow the realistic attack surface versus a true remote-unauthenticated flaw. Net: a legitimate patch-soon issue for exposed/flat IoT networks, but not a widespread-exploitation priority on the signals available. No conflicting signals were observed; the description and CVSS vector agree that access is adjacent and impact is availability-only. |
| Exploit ScenarioDerived | An attacker already on the same local/Wi-Fi network as a Tapo C325WB v2 that has the Camera Account feature enabled sends a crafted pair of RTSP-over-HTTP tunneling requests to TCP port 554. The malformed request pair corrupts memory in the streaming daemon and crashes it, cutting off live video and related streaming until the service recovers or restarts. No public exploit code was identified in the provided data, and no authentication is required (CVSS PR:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Unauthenticated denial of service in the TP-Link Tapo C325WB v2 camera allows a crafted pair of RTSP-over-HTTP tunneling requests sent to the streaming service on TCP port 554 to corrupt memory (stack-based buffer overflow, CWE-121) and crash the streaming daemon, disrupting live video and related streaming functions until the daemon recovers or restarts. Only cameras with the optional Camera Account feature enabled are exposed, and the attacker must be positioned on the same adjacent network segment (Wi-Fi or LAN) as the camera, since the assessed vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; no authentication or user interaction is required. Impact is availability-only and temporary, no public exploit identified at time of analysis, and a vendor patch is available per the TP-Link firmware release notes and advisory FAQ 5333.
RemediationAI
Patch available per vendor advisory (TP-Link firmware release notes for the Tapo C325WB, see https://www.tp-link.com/us/support/download/tapo-c325wb/#Firmware-Release-Notes and the EN equivalent); update the camera to the latest firmware release and apply the guidance in TP-Link FAQ 5333 (https://www.tp-link.com/us/support/faq/5333/). Where immediate patching is not possible, the single most effective compensating control is to disable the Camera Account feature if it is not required, which removes the vulnerable RTSP path from exposure, at the trade-off of losing credential-based RTSP access used by third-party NVRs and clients. Additionally restrict reachability of TCP port 554 so that only trusted management hosts on the same segment can connect, firewall the camera off from guest, IoT-shared, or untrusted Wi-Fi VLANs, and place cameras on a dedicated network segment, accepting the added management overhead of separate VLANs and firewall rules. Note that RTSP over TCP 554 cannot be globally blocked where live streaming to legitimate clients is required, so allowlisting trusted client IPs is preferable to a blanket block, and monitor for repeated daemon restarts as a signal of exploitation attempts.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a stack-based buffer overflow (CWE-121) in the RTSP streaming daemon of the Tapo C325WB v2 camera, reachable over TCP port 554. The trigger is RTSP-over-HTTP tunneling, the mechanism in which RTSP requests are encapsulated inside HTTP requests (typically GET or POST with the RTSP message base64-encoded in the body) so that clients traversing restrictive networks can reach the RTSP stack. Two specially crafted tunneling requests are sufficient to overrun a fixed-size stack buffer, corrupting memory and terminating the daemon. Exposure depends on two conditions: the RTSP listener being reachable on the local network and the optional Camera Account feature being enabled, which is what enables the authenticated RTSP/streaming path used by third-party clients and NVRs. The attack surface is confined to adjacent networks (AV:A) rather than the public internet, and the resulting impact is purely availability (VC:N/VI:N/VA:H in the 4.0 vector, C:N/I:N/A:H in the assessed 3.1 vector); because the daemon restarts after the crash, disruption is temporary rather than persistent or destructive.
Know when Tapo C325Wb V2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Adjacent-network, unauthenticated, no-interaction trigger (AV:A/PR:N/UI:N); the Camera Account prerequisite is a config state, not attacker complexity, so AC:L; impact is availability-only (C:N/I:N/A:H).
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
DescriptionCVE.org
An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Account feature is enabled. A crafted pair of RTSP-over-HTTP tunneling requests can cause memory corruption and crash the streaming daemon.
Successful exploitation may allow an unauthenticated adjacent-network attacker to disrupt live video and related streaming functions until the affected service recovers or restarts.
Articles & Coverage 1
Executive ViewAI
TP-Link Tapo C325WB v2 cameras that have the optional Camera Account feature enabled can experience temporary loss of live video and streaming availability when an attacker on the same Wi-Fi or LAN segment sends crafted traffic. The vulnerability is unauthenticated and availability-only, with no public exploit identified at time of analysis, but a successful disruption could create monitoring blind spots until the affected daemon recovers or the camera restarts. Security and facilities leadership should prioritize confirming exposure and applying the vendor's patch because these devices may support physical security or operational monitoring.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
More in Tapo C325Wb V2
View allTP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass in its HTTPS JSON API dispatcher that allows an
Predictable pre-shared key generation in the TP-Link Tapo C325WB V2 camera's local media streaming service allows an una
Exploit-DB