CVE-2026-1871: TP-Link Tapo C200 DoS Vulnerability

CVE-2026-1871 Overview

CVE-2026-1871 is a stack-based buffer overflow [CWE-121] in the TP-Link Tapo C200 v5 home security camera. The flaw resides in the Real Time Streaming Protocol (RTSP) authentication handler, which fails to validate the length of the Authorization header. An attacker on the adjacent network can send a crafted authentication request to overflow a stack buffer in the RTSP core service. Successful exploitation crashes the RTSP service and triggers an automatic device reboot. The camera becomes unreachable, blocking live video streaming and management access until the service restarts.

Critical Impact

Adjacent network attackers can repeatedly crash the RTSP service and reboot the camera without authentication, producing a sustained denial of service against video surveillance.

Affected Products

• TP-Link Tapo C200 v5 (firmware versions prior to the fixed release noted in vendor advisories)

Discovery Timeline

• 2026-06-02 - CVE-2026-1871 published to NVD
• 2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-1871

Vulnerability Analysis

The Tapo C200 v5 exposes an RTSP service that supports HTTP-style digest authentication. The RTSP core process parses the inbound Authorization header field without enforcing an upper bound on its length before copying its contents into a fixed-size stack buffer. When the supplied header exceeds the buffer capacity, adjacent stack memory is overwritten. The resulting corruption causes the process to crash, and the camera's watchdog responds by rebooting the device. The vulnerability is reachable from any host on the same network segment as the camera and does not require valid credentials.

Root Cause

The root cause is improper validation of input length in the RTSP authentication parsing routine, classified as a stack-based buffer overflow [CWE-121]. The handler treats attacker-controlled header data as bounded input, but no length check is performed before the copy operation. This mirrors classic strcpy-style memory safety failures common in embedded C codebases.

Attack Vector

Exploitation requires the attacker to send a single crafted RTSP request to the camera's streaming port from an adjacent network position, such as the same Wi-Fi network or LAN segment. The crafted request contains an oversized Authorization header that overruns the destination buffer during parsing. No prior authentication, user interaction, or chained vulnerabilities are required to trigger the crash. Repeated requests sustain the denial of service by forcing continuous reboots.

No public proof-of-concept code or verified exploit examples are available. Refer to the TP-Link Tapo C200 Firmware Notes for vendor technical details.

Detection Methods for CVE-2026-1871

Indicators of Compromise

• Unexpected reboots of Tapo C200 v5 cameras, particularly clustered or repeating reboot cycles
• RTSP connections from unexpected adjacent hosts targeting the camera's streaming port
• Inbound RTSP requests containing abnormally long Authorization headers
• Gaps in recorded video footage corresponding to service restarts

Detection Strategies

• Inspect network traffic to identify RTSP DESCRIBE, SETUP, or OPTIONS requests with Authorization header lengths exceeding normal client behavior
• Correlate camera availability monitoring data with network logs to identify reboot patterns following inbound RTSP traffic
• Deploy intrusion detection signatures that flag malformed or oversized RTSP authentication headers on local network segments

Monitoring Recommendations

• Track ICMP and TCP availability of Tapo C200 v5 cameras and alert on repeated reachability loss
• Forward switch and wireless access point logs to a central log platform to identify the originating host of suspicious RTSP traffic
• Monitor DHCP and ARP tables for unauthorized devices joining VLANs that host IoT cameras

How to Mitigate CVE-2026-1871

Immediate Actions Required

• Apply the latest TP-Link Tapo C200 v5 firmware update published by the vendor as soon as it becomes available
• Isolate Tapo C200 v5 cameras on a dedicated IoT VLAN with restricted east-west traffic
• Restrict RTSP port access to known management hosts using network access control lists
• Disable the RTSP service on the camera if it is not required for the deployment

Patch Information

TP-Link addresses the issue through firmware updates for the Tapo C200 v5. Consult the TP-Link Tapo C200 Firmware Release Notes and the TP-Link Tapo C200 FAQ for the fixed version and upgrade instructions.

Workarounds

• Block inbound traffic to RTSP ports from untrusted hosts at the network gateway or wireless controller
• Place cameras behind a segmented network where only authorized video management systems can initiate RTSP sessions
• Disable remote and guest network access to the VLAN hosting the cameras until firmware is updated

# Example: restrict RTSP access to a known management host on a Linux gateway
iptables -A FORWARD -p tcp --dport 554 -s 192.0.2.10 -d 192.0.2.50 -j ACCEPT
iptables -A FORWARD -p tcp --dport 554 -d 192.0.2.50 -j DROP