Tapo C100/C101 CVE-2026-75619

Exploitation requires the attacker to (1) be present on the same local network segment as the target camera (adjacent network, AV:A - internet-based remote exploitation is not possible), and (2) hold valid authentication credentials for the camera (PR:L - unauthenticated exploitation is not possible per the CVSS vector). The target device must be a Tapo C100 or C101 on V5 hardware specifically; other hardware revisions are not confirmed affected. The vulnerability is in the RTSP service, meaning that service must be active and reachable - this is typically enabled by default for live-view streaming. The impact is strictly limited to availability: a successful exploit crashes the RTSP service and triggers a device reboot, providing only a temporary denial-of-service with no path to code execution, data exfiltration, or persistent access.

The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) scores 6.9 and accurately characterizes this as a medium-severity, network-adjacent, authenticated availability issue. Two factors meaningfully reduce real-world risk: the attacker must already hold valid credentials to the camera (PR:L), and must be on the same local network segment (AV:A), ruling out remote internet-based exploitation. The impact ceiling is a temporary service interruption - the camera reboots and resumes normal operation, limiting business impact to brief camera downtime. No EPSS data was provided and this CVE is not listed in the CISA KEV catalog, consistent with the low exploitation priority signal. No public exploit code has been identified. For home and SMB deployments, the primary realistic threat is a rogue insider or a compromised local network device pivoting to disrupt camera coverage. The absence of confidentiality or integrity impact (VC:N/VI:N) means camera footage cannot be accessed or altered through this vulnerability alone.

An attacker who has obtained valid credentials for a Tapo C100 or C101 V5 camera - through credential stuffing, default password reuse, or prior network compromise - connects to the camera's RTSP service from the local network and sends a crafted RTSP frame with an oversized length field. The oversized value triggers an out-of-bounds heap write in the RTSP service, causing it to crash and forcing the camera to reboot, eliminating camera coverage for the duration of the reboot cycle. No public exploit code has been identified, meaning a potential attacker would need to develop their own proof-of-concept against the RTSP parser.