CVE-2026-104944 in Tapo C500
Summary
by MITRE • 10/06/2026
TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in a denial-of-service condition.
Successful exploitation may allow an unauthenticated attacker with network access to the affected UDP service to repeatedly crash the TDP daemon, disrupting normal device operation and availability. No authentication, session establishment, or pairing is required to trigger the condition.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in TP-Link Tapo C500 v2.0 represents a critical security flaw within its proprietary communication protocol implementation. Specifically, an out-of-bounds function-pointer dispatch exists in the TDP daemon, which handles device-to-cloud and local network communications. This architectural weakness allows for remote code execution or denial of service through malformed input handling. The core issue stems from insufficient validation of incoming UDP datagrams before they are processed by the protocol handler. When a specifically crafted packet is received, the system attempts to interpret it as a valid command structure but fails due to missing bounds checking on function pointers. This leads directly to an invalid indirect call where the processor jumps to a memory address that does not contain executable code or lies outside the allocated heap space for the daemon's control structures.
From a technical perspective, this flaw is classified under CWE-94 as Improper Control of Generation of Code (Code Injection) and more specifically relates to improper validation of function pointers which can lead to arbitrary code execution if the attacker controls the memory layout sufficiently. However in this specific instance the immediate consequence observed is a crash rather than full remote code execution due to modern operating system protections such as non-executable stacks or address space layout randomization preventing stable exploitation for shell access. The vulnerability falls under MITRE ATT&CK technique T1498 Network Denial of Service where an attacker disrupts availability by exhausting resources or crashing services without needing prior authentication credentials.
The operational impact of this vulnerability is severe because it requires no authentication session establishment or pairing process to trigger the condition. An unauthenticated actor with network access to the affected UDP service can send a single malformed datagram that causes immediate instability in the TDP daemon. Repeated exploitation allows for sustained denial-of-service conditions effectively rendering the smart camera offline and unusable until the device is manually rebooted. This impacts not only individual users but also potentially disrupts broader IoT ecosystems if multiple devices are targeted simultaneously creating large-scale outages for home automation systems relying on continuous video feeds or motion detection alerts from these cameras.
Mitigation strategies should focus primarily on network segmentation to limit exposure of vulnerable services to untrusted networks since no patch may be immediately available depending on vendor response times. Users should isolate IoT devices on separate VLANs with strict firewall rules that restrict UDP traffic destined for the TDP port only to trusted management subnets if remote access is not required. Additionally enabling automatic firmware updates when released by TP-Link remains crucial as vendors typically address such critical flaws in subsequent releases until then monitoring device logs for unusual restart patterns can help detect ongoing exploitation attempts while maintaining physical security around network infrastructure to prevent local attackers from gaining initial foothold on the LAN segment hosting these devices