Tapo C320WS CVE-2026-105810

Exploitation requires the attacker to (1) be on the adjacent network segment used for the camera's local onboarding (AV:A - not routable internet access), and (2) hold valid authentication to the device (PR:H). The specific trigger is the local onboarding Wi-Fi configuration path: the attacker must reach that onboarding/provisioning endpoint and supply a crafted request with an oversized encrypted password field that overflows the stack buffer. Limiting factors that reduce real-world risk: the device must be reachable on the local/adjacent network (typical home or provisioning LAN, not WAN), the attacker must already be authenticated, and only the Tapo C320WS V2.0 hardware/firmware is affected. No user interaction is required (UI:N), and successful exploitation yields root, so an already-authenticated adjacent attacker faces low complexity (AC:L).

This is a genuine but conditionally-gated issue rather than a drop-everything emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:H/UI:N, score 8.5) tells a consistent story with the description: exploitation requires adjacent-network access (not internet-facing remote) and high privileges (PR:H), meaning the attacker must already be authenticated to the camera's local onboarding interface. The high VC/VI/VA impacts (root command execution) justify the High severity, but the two preconditions - physical/network adjacency plus valid authentication - materially reduce real-world exploitability versus a true unauthenticated remote RCE. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis; the absence of KEV combined with the authenticated/adjacent constraints suggests this is not a candidate for widespread automated exploitation. No SSVC decision data was supplied. The principal signals (CVSS vector and description) are mutually consistent - both point to authenticated adjacent access - so there is no major conflict to flag, though the practical bar (already-authenticated adjacent attacker) means the residual risk is dominated by insider, shared-network, or post-compromise scenarios rather than mass exploitation.

An attacker already authenticated to a Tapo C320WS V2.0 camera and present on the same adjacent network (e.g. the local Wi-Fi or onboarding segment) submits a crafted onboarding request carrying an oversized encrypted password field. The oversized field overflows a stack buffer in the Wi-Fi configuration handler, overwriting stack state and yielding arbitrary command execution as root. No public exploit code was identified at time of analysis, and the attack requires valid credentials plus network adjacency (CVSS AV:A/PR:H).