CVE-2026-1871: tp-link systems inc. tapo c200 v5 Stack-based Buffer Overflow

Vulnerability summary

CVE-2026-1871 is a high (CVSS 7.1) Stack-based Buffer Overflow vulnerability in tp-link systems inc. tapo c200 v5. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 22% of scored vulnerabilities.

Timeline

1. 02-06-2026
   PublishedVulnerability first disclosed.
2. 02-06-2026
   Last modifiedVulnerability information updated.

Description

TP-Link Tapo C200 v5 contains a stack-based buffer overflow flaw in RTSP authentication handling due to improper validation of Authorization header field lengths, which can be triggered by a crafted authentication request. Successful exploitation causes the affected RTSP core service process to crash and triggers an automatic system reboot, resulting in a denial of service (DoS) condition. This prevents legitimate users from accessing the camera’s live video stream or management interface until the service restarts.

• CWE-121Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).