CVE-2026-104945: TP-Link Tapo C500 DoS Vulnerability

CVE-2026-104945 Overview

CVE-2026-104945 is an out-of-bounds stack write vulnerability affecting the TP-Link Tapo C500 v2.0 network camera. The flaw resides in the camera's Open Network Video Interface Forum (ONVIF) Pan-Tilt-Zoom (PTZ) Simple Object Access Protocol (SOAP) handlers. An authenticated ONVIF client can submit SOAP requests containing an excessive number of preset-related elements. The handlers write these elements beyond the bounds of fixed-size stack arrays, which crashes the affected service. The vulnerability is tracked as a stack-based buffer overflow [CWE-121].

Critical Impact
Successful exploitation produces a denial-of-service condition that disrupts camera management and PTZ functionality. Repeated requests can keep the service offline until it recovers or restarts.

Affected Products

TP-Link Tapo C500 v2.0
ONVIF PTZ SOAP handler component
Firmware versions prior to the vendor fix (see TP-Link Tapo C500 Firmware Notes)

Discovery Timeline

2026-10-06 - CVE-2026-104945 published to the National Vulnerability Database (NVD)
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-104945

Vulnerability Analysis

The Tapo C500 exposes an ONVIF interface for standards-based camera management, including PTZ control. ONVIF uses SOAP over HTTP as its transport. PTZ preset operations such as GetPresets, SetPreset, GotoPreset, and RemovePreset allow clients to manage saved camera positions.

The affected SOAP handlers allocate fixed-size arrays on the stack to hold preset-related elements parsed from incoming requests. The handlers do not validate the number of preset elements before copying them into these buffers. When an authenticated client supplies more elements than the array can hold, the handler writes past the end of the buffer, corrupting adjacent stack memory and crashing the service.

Because the vulnerable code path requires valid ONVIF credentials and network reachability to the camera, exploitation is limited to authenticated users on an adjacent network segment.

Root Cause

The root cause is missing bounds checking in the ONVIF PTZ SOAP parsing logic. The handlers trust the count of preset elements supplied by the client and iterate over the input without verifying it fits inside the fixed-size stack buffer. This condition maps to CWE-121 (Stack-based Buffer Overflow).

Attack Vector

An attacker with ONVIF credentials sends a crafted SOAP request to the camera over an adjacent network. The request contains a large number of preset-related XML elements. Parsing the oversized request triggers the out-of-bounds stack write and crashes the ONVIF service, halting PTZ and management functionality until the service recovers.

No verified public exploit code is available. See the TP-Link Tapo C500 FAQ for ONVIF configuration context.

Detection Methods for CVE-2026-104945

Indicators of Compromise

Unexpected restarts or crashes of the ONVIF service on Tapo C500 cameras
SOAP requests to ONVIF PTZ endpoints containing abnormally large numbers of preset elements
Repeated authentication followed by service unavailability on TCP ports used by ONVIF
Loss of PTZ control or management console connectivity to the affected camera

Detection Strategies

Inspect SOAP payloads targeting ONVIF PTZ methods for abnormal element counts and oversized request bodies
Correlate ONVIF authentication events with subsequent service crash or restart telemetry from the camera
Baseline normal PTZ preset request patterns and alert on deviations from expected volume and structure

Monitoring Recommendations

Capture network traffic between management stations and cameras on the video VLAN for post-incident analysis
Monitor camera availability and ONVIF service uptime through network management tooling
Forward syslog or SNMP traps from camera infrastructure into a central logging platform for alerting on repeated service failures

How to Mitigate CVE-2026-104945

Immediate Actions Required

Update affected Tapo C500 v2.0 cameras to the latest firmware published in the TP-Link Tapo C500 Firmware Notes
Restrict ONVIF access to trusted management hosts using network segmentation and access control lists
Rotate ONVIF credentials and enforce strong, unique passwords for each camera account
Disable ONVIF on cameras where it is not required for integration with a video management system

Patch Information

TP-Link publishes firmware updates for the Tapo C500 through its official support portal. Review the TP-Link Tapo C500 Firmware Notes for the version that addresses CVE-2026-104945 and apply it to all deployed units.

Workarounds

Place cameras on an isolated management VLAN that blocks untrusted clients from reaching ONVIF ports
Terminate ONVIF behind a reverse proxy or firewall that enforces request size limits and rate limiting
Remove or disable unused ONVIF user accounts to reduce the authenticated attack surface

bash

# Example firewall rule limiting ONVIF access to a trusted management host
iptables -A INPUT -p tcp --dport 2020 -s 10.10.50.25 -j ACCEPT
iptables -A INPUT -p tcp --dport 2020 -j DROP