Tapo C500 V2 0
Monthly
Unauthenticated attackers with adjacent-network access can crash the TDP daemon on TP-Link Tapo C500 v2.0 cameras by sending a single crafted UDP datagram, causing a denial-of-service condition. The flaw is an out-of-bounds function-pointer dispatch (CWE-823) that triggers an invalid indirect call, and the CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) plus our independent CVSS 3.1 assessment (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirm only availability is impacted-no data disclosure or code execution. No public exploit code or active exploitation is identified in the provided data, but the vendor has released a patch; the attack requires Layer-2 adjacency and no authentication, session, or pairing.
TP-Link Tapo C500 v2.0 cameras with the ONVIF PTZ interface enabled are vulnerable to an out-of-bounds stack write (CWE-121) that can be triggered by an authenticated ONVIF client sending an excessive number of preset-related elements to the PTZ SOAP handlers, resulting in a service crash and denial-of-service. Exploitation requires valid ONVIF credentials and adjacency to the camera's network (CVSS 4.0: 6.8, AV:A/PR:H), and while the attacker cannot execute code or access data, repeated crashes can disrupt camera management and PTZ functionality until the service restarts. TP-Link has released a firmware patch, and no public exploit code has been identified at time of analysis.
Unauthenticated attackers with adjacent-network access can crash the TDP daemon on TP-Link Tapo C500 v2.0 cameras by sending a single crafted UDP datagram, causing a denial-of-service condition. The flaw is an out-of-bounds function-pointer dispatch (CWE-823) that triggers an invalid indirect call, and the CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) plus our independent CVSS 3.1 assessment (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirm only availability is impacted-no data disclosure or code execution. No public exploit code or active exploitation is identified in the provided data, but the vendor has released a patch; the attack requires Layer-2 adjacency and no authentication, session, or pairing.
TP-Link Tapo C500 v2.0 cameras with the ONVIF PTZ interface enabled are vulnerable to an out-of-bounds stack write (CWE-121) that can be triggered by an authenticated ONVIF client sending an excessive number of preset-related elements to the PTZ SOAP handlers, resulting in a service crash and denial-of-service. Exploitation requires valid ONVIF credentials and adjacency to the camera's network (CVSS 4.0: 6.8, AV:A/PR:H), and while the attacker cannot execute code or access data, repeated crashes can disrupt camera management and PTZ functionality until the service restarts. TP-Link has released a firmware patch, and no public exploit code has been identified at time of analysis.