Read the docs
TI-2026-05483 Aliases CVE-2026-6250GHSA-4gmj-9m2m-6h5f

Authenticated Format String Injection on TP-Link Tapo C110

Priority LOW 31CWE-134Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling of user-controlled input.  Externally controlled data is interpreted as a format string, which can be used to manipulate stack memory, including control flow data such as return addresses. A remote authenticated attacker may redirect execution flow to existing internal functions, triggering an unauthorized factory reset, leading to loss of configuration, deletion of stored credentials and service disruption.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00463 40th percentileScored 2026-11-07
Fix Fixed Tapo C110 v2 (TP-Link Systems Inc.): 1.5.4 Build 260428

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkTapo C110 v2before 1.5.4 Build 2604281.5.4 Build 260428Patch availableCNA
  • Tapo C110 v2 VendorTP-Link Affected before 1.5.4 Build 260428 Fixed in 1.5.4 Build 260428 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:tapo_c110_firmware:*:*:*:*:*:*:*:*before 1.5.4VulnerableTP-Link
cpe:2.3:h:tp-link:tapo_c110:2.0:*:*:*:*:*:*:*2.0Running onTP-Link
  • cpe:2.3:o:tp-link:tapo_c110_firmware:*:*:*:*:*:*:*:* Versions before 1.5.4 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:tapo_c110:2.0:*:*:*:*:*:*:* Versions 2.0 Running on ·TP-Link

Remediation

  • Fix · CNA Tapo C110 v2 (TP-Link Systems Inc.) Fixed in 1.5.4 Build 260428

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-6250
  2. 2026-10-03 Alias added: GHSA-4gmj-9m2m-6h5f
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 3

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences