TP-Link Tapo C320WS: Authenticated stack-based buffer overflow in Wi-Fi onboarding
Summary
The Tapo C320WS camera (hardware V2) contains a stack-based buffer overflow in the local Wi-Fi onboarding configuration path. An authenticated attacker on the adjacent network can send a crafted request with an oversized encrypted password field, which can lead to command execution with root privileges. Successful exploitation could allow full control of the camera, access to its local configuration and video, and disruption of the device.
Affected
- Tapo C320WS hardware V2.0 with firmware before 1.6.6 Build 260917 Rel.81089n (per CVE record; vendor confirmation pending)
- Default configuration: unaffected per CNA record
- Other hardware revisions: Unknown.
Fixed in
- Firmware 1.6.6 Build 260917 Rel.81089n or later (per CVE record; not yet verified against the vendor advisory)
Workaround
- No workaround is documented in the CVE record.
- Unverified: disable or block the Wi-Fi onboarding endpoint until the firmware is updated.
- Isolate the camera on a dedicated IoT network segment.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total.
- Not listed in CISA KEV.
- A public proof-of-concept repository exists; its code was not reviewed.
- No confirmed in-the-wild exploitation found.
Our recommendation
- Inventory all Tapo C320WS units and record hardware revision and firmware build.
- Update V2 units to 1.6.6 Build 260917 Rel.81089n or later after checking the TP-Link advisory.
- Move cameras to an isolated VLAN without access to workstations or servers, and disable onboarding mode after setup.
- Verify that no port forwarding or cloud relay exposes the device.
- Recheck NVD and the TP-Link advisory in two weeks for changes to the affected range or authentication requirement.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
M0ud4/CVE-2026-105810
Research sources
- TP-Link Tapo C320WS V2 firmware download (EN) www.tp-link.com
- TP-Link Tapo C320WS firmware download (US) www.tp-link.com
- TP-Link FAQ 5351 (vendor advisory reference) www.tp-link.com
- OpenCVE CVE-2026-105810 app.opencve.io
- Strix AI CVE-2026-105810 www.strix.ai
- threatint CVE-2026-105810 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:23.
Original description (NVD)
Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path. An authenticated attacker on the adjacent network can submit a crafted request containing an oversized encrypted password field, overwrite stack state, and execute commands with root privileges. Successful exploitation may allow an authenticated adjacent-network attacker to take control of the affected camera, modify camera behavior, access sensitive local configuration, and disrupt device availability.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.