CVE-2026-1871: TP-Link Tapo C200 v5 RTSP Buffer Overflow DoS Vulnerability

Technical summary

The vulnerability is a stack-based buffer overflow (CWE-121) in the RTSP authentication handler of TP-Link Tapo C200 v5 firmware. The root cause is insufficient validation of the Authorization header field length in RTSP requests. When an attacker sends an oversized Authorization header, the parser fails to enforce bounds checking and writes beyond the allocated stack buffer. This memory corruption triggers a crash of the RTSP core service process, which the camera's watchdog or system logic interprets as a fatal error, initiating an automatic reboot. The vulnerability requires network adjacency (local network access) and no authentication to trigger, but results only in denial of service rather than code execution or information disclosure.

Business impact

Organizations deploying Tapo C200 v5 cameras for surveillance, access monitoring, or physical security lose real-time visibility and remote management capability during attacks. For businesses relying on continuous security monitoring, even brief outages create blind spots. Repeated exploitation (the vulnerability is not self-healing) can disrupt operations and confidence in the surveillance infrastructure. The impact is contained to availability; no sensitive data is exposed or corrupted by this flaw.

Affected systems

TP-Link Tapo C200 v5 firmware is confirmed affected. The vulnerability is specific to version 5 of the Tapo C200 hardware model; other Tapo or TP-Link models and firmware versions may have different exposure. Organizations should verify their exact hardware revision and firmware version before applying mitigations. Consult TP-Link's security advisories for the precise list of affected firmware builds and any mention of other Tapo models.

Exploitability

The vulnerability has a CVSS 3.1 score of 6.5 (MEDIUM severity). It is exploitable over a local network without requiring the attacker to authenticate to the camera beforehand or interact with a user. The attack is straightforward: craft and send a malformed RTSP Authorization header. However, it does not appear in the CISA Known Exploited Vulnerabilities catalog, suggesting active exploitation in the wild is not yet documented. The barrier to local network access and the denial-of-service-only outcome (no remote code execution) reduce the urgency, but the simplicity of the attack means opportunistic exploitation by local network adversaries is plausible.

Remediation

Apply TP-Link's patched firmware for Tapo C200 v5 as soon as it becomes available. Mitigating controls include: (1) restricting RTSP access to trusted local network segments or a VPN; (2) disabling RTSP access if not actively used; (3) segmenting cameras onto a dedicated IoT network separate from critical infrastructure; (4) implementing network monitoring to detect unusual RTSP traffic patterns. These measures reduce exposure but do not eliminate the vulnerability until a patch is deployed.

Patch guidance

Monitor TP-Link's official security advisories and support portal for a patched firmware release for Tapo C200 v5. When available, update the camera via its web management interface or mobile app, following TP-Link's documented update procedure. Firmware updates for Tapo cameras typically require the device to be powered and connected to the network. Test the update in a non-critical environment first if possible. Verify the camera's firmware version post-update to confirm the patch was successfully applied. Maintain a record of firmware versions in your asset inventory to track compliance.

Detection guidance

Monitor network traffic for unusually long or malformed RTSP Authorization headers destined to Tapo C200 devices. Look for repeated RTSP connection failures followed by camera reboot events in your device logs or network security tools. If available, enable debug or verbose logging on the camera's RTSP service. In the absence of detailed logs, correlate camera downtime events with suspicious inbound RTSP traffic. Network intrusion detection systems (IDS) or next-generation firewalls with RTSP inspection may flag oversized Authorization headers if properly tuned. Note that simple DoS attacks often go unnoticed until users report access issues, so proactive network monitoring is valuable.

Why prioritize this

Prioritize patching based on environment and camera usage. High-priority if the camera is mission-critical for physical security or compliance monitoring, or if it is exposed to a hostile or semi-trusted local network. Medium-priority in controlled corporate environments with restricted network access and low-security cameras. Low-priority for cameras in locked-down networks with no untrusted users. Since the flaw is not yet widely exploited (not in CISA KEV) and requires local network access, organizations in secure, isolated networks may defer patching until patch verification and deployment resources are available, but should plan an update cycle within 90 days.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a MEDIUM-severity denial-of-service vulnerability. The Attack Vector is Adjacent (local network only), which reduces severity compared to remotely exploitable flaws. Attack Complexity is Low, meaning an attacker with network access can trivially craft the trigger. Privileges Required and User Interaction are both None, increasing exploitability. The impact is limited to Availability (high), with no Confidentiality or Integrity impact. The score appropriately balances the straightforward attack mechanism against the limited scope of harm. However, in environments where camera availability is operationally critical, the business impact may warrant treating this as higher-priority than the base CVSS score suggests.

Frequently asked questions