All vulnerabilities
CVE-2026-104944

Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500

TP-Link Systems Inc. Tapo C500 v2.0Network & edge
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 21% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1.3.5 Build 260810Fixed versionCVE List
Published6 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 1.3.5 Build 260810Tapo C500 v2.0CVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in a denial-of-service condition.

Successful exploitation may allow an unauthenticated attacker with network access to the affected UDP service to repeatedly crash the TDP daemon, disrupting normal device operation and availability. No authentication, session establishment, or pairing is required to trigger the condition.

Text from CVE List

Affected versions 1

  • Tapo C500 v2.0affected: all versions before 1.3.5 Build 260810CVE List

References 3