Tapo C320WS (V2.0, <= 1.5.3 Build 260304) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/tapo-c320ws-v2.0--1.5.3-build-260304/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 20 Oct 2026 18:42:16 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTP-Link Tapo C320WS: Stack-based buffer overflow RCE (CVE-2026-105810)https://feed.craftedsignal.io/briefs/2026-10-tplink-tapo-c320ws-rce/Tue, 20 Oct 2026 18:42:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-tplink-tapo-c320ws-rce/An authenticated stack-based buffer overflow in the TP-Link Tapo C320WS camera allows remote code execution as root via the Wi-Fi onboarding process.CVE-2026-105810 is a high-severity, authenticated stack-based buffer overflow vulnerability affecting the TP-Link Tapo C320WS camera (hardware V2.0, firmware ≤ 1.5.3 Build 260304). The vulnerability resides in the onboarding.connect (connectAp) handler, which incorrectly calculates the destination capacity when base64-decoding a user-supplied Wi-Fi password. By providing an overly long, crafted password string, an authenticated administrative user on the adjacent network can overflow a fixed 1024-byte stack buffer. Because the vulnerable binary is a non-PIE ARM executable lacking stack canaries, an attacker can reliably execute arbitrary code as root by redirecting execution flow via a ROP chain to call system(). A functional proof-of-concept exploit is publicly available, necessitating immediate patching to firmware 1.6.6 Build 260917 Rel.81089n or later.

Attack Chain

  1. Attacker gains administrative authentication to the target TP-Link Tapo C320WS local API.
  2. Attacker interacts with the onboarding.connect (connectAp) handler via the device local management interface.
  3. Attacker submits a specially crafted, base64-encoded Wi-Fi password string exceeding 1024 bytes.
  4. The device decoder incorrectly determines buffer capacity, leading to memory corruption.
  5. The stack-based buffer overflow overwrites the function return address on the stack.
  6. The corrupted return address redirects the processor to an attacker-controlled ROP chain.
  7. The ROP chain executes system() to run arbitrary commands on the underlying device.
  8. Attacker gains full root command execution capabilities on the camera.

Impact

Successful exploitation results in full remote command execution as the root user on the camera. This provides attackers with total control over the device, allowing them to intercept surveillance feeds, pivot into the local network, or use the camera as a foothold for further malicious activity. This vulnerability affects TP-Link Tapo C320WS cameras running firmware version 1.5.3 Build 260304 or earlier.

Recommendation

  • Patch all TP-Link Tapo C320WS cameras to firmware version 1.6.6 Build 260917 Rel.81089n or later immediately.
  • Implement network segmentation for IoT devices to restrict access to the camera's management API (TCP/443) to authorized administrative workstations only.
  • Audit administrative account passwords and ensure strong credentials are used to prevent unauthorized access to the vulnerable API endpoints.
  • Monitor network traffic originating from IoT segments for unexpected command execution patterns or ROP chain remnants if advanced network inspection is available.
]]>highadvisorycve-2026-105810rceiot-security