TP-Link Tapo C110 v2 ONVIF Service format string

Summaryinfo

A vulnerability described as critical has been identified in TP-Link Tapo C110 v2. Affected by this issue is some unknown functionality of the component ONVIF Service. The manipulation results in format string. This vulnerability is identified as CVE-2026-6250. The attack can only be performed from the local network. There is not any exploit available.

Detailsinfo

A vulnerability was found in TP-Link Tapo C110 v2 (unknown version). It has been classified as critical. Affected is an unknown code block of the component ONVIF Service. The manipulation with an unknown input leads to a format string vulnerability. CWE is classifying the issue as CWE-134. The product uses a function that accepts a format string as an argument, but the format string originates from an external source. This is going to have an impact on integrity, and availability. CVE summarizes:

An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling of user-controlled input.  Externally controlled data is interpreted as a format string, which can be used to manipulate stack memory, including control flow data such as return addresses. A remote authenticated attacker may redirect execution flow to existing internal functions, triggering an unauthorized factory reset, leading to loss of configuration, deletion of stored credentials and service disruption.

The weakness was released by juhye0p. The advisory is shared for download at tp-link.com. This vulnerability is traded as CVE-2026-6250 since 04/13/2026. The exploitability is told to be easy. Access to the local network is required for this attack. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/12/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• TP-Link

Name

• Tapo C110 v2

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion