What’s Vulnerable › Vulnerabilities

CVE-2026-6250: Authenticated Format String Injection on TP-Link Tapo C110

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-11 · updated 2026-10-26
• Weakness: CWE-134

Description

An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling of user-controlled input.  Externally controlled data is interpreted as a format string, which can be used to manipulate stack memory, including control flow data such as return addresses. A remote authenticated attacker may redirect execution flow to existing internal functions, triggering an unauthorized factory reset, leading to loss of configuration, deletion of stored credentials and service disruption.

Affected products

• TP-Link Systems Inc. Tapo C110 v2: before 1.5.4 — fixed in 1.5.4

How to fix

Upgrade to a fixed version: TP-Link Systems Inc. Tapo C110 v2 1.5.4. Check the vendor advisory for mitigations.

References

• https://www.tp-link.com/en/support/download/tapo-c110/v2/#Firmware-Release-Notes
• https://www.tp-link.com/kr/support/download/tapo-c110/v2/#Firmware-Release-Notes
• https://www.tp-link.com/us/support/download/tapo-c110/v2/#Firmware-Release-Notes
• https://www.tp-link.com/us/support/faq/5128/

Get alerted when CVE-2026-6250 or the next vulnerability affects your stack