Key points
- CVE-2026-105810 affects Tapo C320WS v2.0 firmware versions prior to 1.6.6 Build 260917 Rel.81089n.
- The flaw enables authenticated attackers on adjacent networks to overwrite stack state and gain root access.
- National Vulnerability Database rates the vulnerability as high severity with a CVSS score of 8.5.
TP-Link Systems Inc. Tapo C320WS v2.0 cameras running firmware before version 1.6.6 Build 260917 Rel.81089n contain a security flaw. The issue involves an authenticated stack-based buffer overflow within the local onboarding Wi-Fi configuration path. Attackers who have already authenticated to the device can exploit this weakness. They must be located on an adjacent network to launch the attack successfully.
In plain English
The vulnerability exists in how the camera processes Wi-Fi setup requests. An attacker can send a crafted request that includes an encrypted password field larger than expected. This oversized input overwrites the device's stack memory. The overflow allows the attacker to execute arbitrary commands. Those commands run with root privileges on the camera system.
The background
The National Vulnerability Database lists this issue as CVE-2026-105810. It carries a CVSS score of 8.5, which classifies it as high severity. The weakness is categorized under CWE-121 for stack-based buffer overflows. Successful exploitation gives the attacker full control over the affected camera. They can modify camera behavior and access sensitive local configuration data.
What changes now
Attackers who gain root access can disrupt device availability. They may also alter how the camera records or streams video. This changes the trust model for devices using older firmware versions. Organizations must verify their current firmware versions against the affected range. Any device running a version before 1.6.6 Build 260917 Rel.81089n is at risk.
Who needs to act first
Teams should prioritize updating cameras that face external or untrusted network segments. Isolate affected devices from critical internal systems while verifying firmware versions. Check whether any cameras are currently undergoing onboarding procedures, as this path is vulnerable. Backup existing configurations before applying any updates to prevent data loss. Monitor network traffic for unusual authentication attempts on adjacent segments.
What to do and how to stay safe: TP-Link
- Verify the firmware version on all Tapo C320WS v2.0 cameras in your environment.
- Update devices to version 1.6.6 Build 260917 Rel.81089n or later once available.
- Restrict network access to camera management interfaces to trusted administrators only.
- Monitor logs for failed authentication attempts or unusual Wi-Fi configuration requests.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which specific firmware versions are affected by CVE-2026-105810?
The vulnerability affects TP-Link Tapo C320WS v2.0 firmware versions before 1.6.6 Build 260917 Rel.81089n.
Can an attacker exploit this flaw remotely over the internet?
No, the attacker must be authenticated and located on an adjacent network to the device.
What privileges does an attacker gain after successful exploitation?
An attacker can execute commands with root privileges on the affected camera system.
