{"schema":"threatline.record/2","record":{"id":"CVE-2026-104944","aliases":[],"summary":"Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500","details":"TP-Link Tapo\nC500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP\n(TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can\ncause an invalid indirect call, crashing the main service and resulting in a\ndenial-of-service condition.\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated attacker with network access to the\naffected UDP service to repeatedly crash the TDP daemon, disrupting normal\ndevice operation and availability. No authentication, session establishment, or\npairing is required to trigger the condition.","categories":["Network & edge"],"product":"Tapo C500 v2.0","vendor":"TP-Link Systems Inc.","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104944","source_modified_at":"2026-10-07T14:02:34.899Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"Tapo C500 v2.0","vendor":"TP-Link Systems Inc.","versions":[{"status":"affected","version":"0","lessThan":"1.3.5 Build 260810","versionType":"custom"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-104944","source_modified_at":"2026-10-07T14:02:34.899Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"Tapo C500 v2.0","ecosystem":null},"version":"1.3.5 Build 260810","basis":"first unaffected version stated in the CVE record"}],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00297,"percentile":0.21252,"score_date":"2026-10-23"},"published_at":"2026-10-06T18:40:58.935Z","modified_at":"2026-10-07T14:02:34.899Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-104944","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-07T14:02:34.899Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-104944","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.tp-link.com/us/support/download/tapo-c500/#Firmware-Release-Notes","tags":["patch"]},{"source":"CVE List","url":"https://www.tp-link.com/en/support/download/tapo-c500/#Firmware-Release-Notes","tags":["patch"]},{"source":"CVE List","url":"https://www.tp-link.com/us/support/faq/5327/","tags":["vendor-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-07T14:02:17.137504Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"vendor and product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-07T14:02:34.899Z","content_hash":"3eabbaf2716ad1fb9d01eebb9f52a2b3981d6719898aa0df4000116b85a051ba"}}