8.1

CVE-2026-6250

Authenticated Format String Injection on TP-Link Tapo C110

An
authenticated format string vulnerability exists in the ONVIF service of Tapo
C110 v2 due to improper handling of user-controlled input.  Externally controlled data is interpreted as
a format string, which can be used to manipulate stack memory, including
control flow data such as return addresses.





A remote
authenticated attacker may redirect execution flow to existing internal
functions, triggering an unauthorized factory reset, leading to loss of
configuration, deletion of stored credentials and service disruption.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tp-link ≫ Tapo C110 Firmware Version < 1.5.4
   Tp-link ≫ Tapo C110 Version2.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.46% 0.365
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
f23511db-6c3e-4e32-a477-6aa17d310630 7 0 0
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-134 Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

https://www.tp-link.com/us/support/download/tapo-c110/v2/#Firmware-Release-Notes
Release Notes
https://www.tp-link.com/en/support/download/tapo-c110/v2/#Firmware-Release-Notes
Release Notes
https://www.tp-link.com/kr/support/download/tapo-c110/v2/#Firmware-Release-Notes
Release Notes
https://www.tp-link.com/us/support/faq/5128/
Vendor Advisory