{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3htp-linktapo_c320ws2.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:h:tp-link:tapo_c320ws:2.0:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-105810"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Tapo C320WS (V2.0, \u003c= 1.5.3 Build 260304)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-105810","rce","iot-security"],"_cs_type":"advisory","_cs_vendors":["TP-Link"],"content_html":"\u003cp\u003eCVE-2026-105810 is a high-severity, authenticated stack-based buffer overflow vulnerability affecting the TP-Link Tapo C320WS camera (hardware V2.0, firmware ≤ 1.5.3 Build 260304). The vulnerability resides in the \u003ccode\u003eonboarding.connect\u003c/code\u003e (\u003ccode\u003econnectAp\u003c/code\u003e) handler, which incorrectly calculates the destination capacity when base64-decoding a user-supplied Wi-Fi password. By providing an overly long, crafted password string, an authenticated administrative user on the adjacent network can overflow a fixed 1024-byte stack buffer. Because the vulnerable binary is a non-PIE ARM executable lacking stack canaries, an attacker can reliably execute arbitrary code as root by redirecting execution flow via a ROP chain to call \u003ccode\u003esystem()\u003c/code\u003e. A functional proof-of-concept exploit is publicly available, necessitating immediate patching to firmware \u003ccode\u003e1.6.6 Build 260917 Rel.81089n\u003c/code\u003e or later.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains administrative authentication to the target TP-Link Tapo C320WS local API.\u003c/li\u003e\n\u003cli\u003eAttacker interacts with the \u003ccode\u003eonboarding.connect\u003c/code\u003e (\u003ccode\u003econnectAp\u003c/code\u003e) handler via the device local management interface.\u003c/li\u003e\n\u003cli\u003eAttacker submits a specially crafted, base64-encoded Wi-Fi password string exceeding 1024 bytes.\u003c/li\u003e\n\u003cli\u003eThe device decoder incorrectly determines buffer capacity, leading to memory corruption.\u003c/li\u003e\n\u003cli\u003eThe stack-based buffer overflow overwrites the function return address on the stack.\u003c/li\u003e\n\u003cli\u003eThe corrupted return address redirects the processor to an attacker-controlled ROP chain.\u003c/li\u003e\n\u003cli\u003eThe ROP chain executes \u003ccode\u003esystem()\u003c/code\u003e to run arbitrary commands on the underlying device.\u003c/li\u003e\n\u003cli\u003eAttacker gains full root command execution capabilities on the camera.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full remote command execution as the root user on the camera. This provides attackers with total control over the device, allowing them to intercept surveillance feeds, pivot into the local network, or use the camera as a foothold for further malicious activity. This vulnerability affects TP-Link Tapo C320WS cameras running firmware version 1.5.3 Build 260304 or earlier.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch all TP-Link Tapo C320WS cameras to firmware version \u003ccode\u003e1.6.6 Build 260917 Rel.81089n\u003c/code\u003e or later immediately.\u003c/li\u003e\n\u003cli\u003eImplement network segmentation for IoT devices to restrict access to the camera's management API (TCP/443) to authorized administrative workstations only.\u003c/li\u003e\n\u003cli\u003eAudit administrative account passwords and ensure strong credentials are used to prevent unauthorized access to the vulnerable API endpoints.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic originating from IoT segments for unexpected command execution patterns or ROP chain remnants if advanced network inspection is available.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T18:42:16Z","date_published":"2026-10-20T18:42:16Z","id":"https://feed.craftedsignal.io/briefs/2026-10-tplink-tapo-c320ws-rce/","summary":"An authenticated stack-based buffer overflow in the TP-Link Tapo C320WS camera allows remote code execution as root via the Wi-Fi onboarding process.","title":"TP-Link Tapo C320WS: Stack-based buffer overflow RCE (CVE-2026-105810)","url":"https://feed.craftedsignal.io/briefs/2026-10-tplink-tapo-c320ws-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:h:tp-Link:tapo_c320ws:2.0:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}