CVE-2026-104945

Executive Summary

CVE-2026-104945 is an out-of-bounds stack write vulnerability (CWE-121) in the ONVIF PTZ SOAP handlers of the TP-Link Tapo C500 v2.0 smart camera. An authenticated ONVIF client can submit an excessive number of preset-related elements, causing writes beyond fixed-size stack arrays and crashing the affected service. The impact is denial of service — repeated exploitation can persistently disrupt camera management and PTZ functionality until the service recovers or the device restarts.

Technical Analysis

The vulnerability resides in the ONVIF PTZ (Pan-Tilt-Zoom) SOAP handler implementation. ONVIF is an open industry standard for IP-based physical security products that relies on SOAP/XML over HTTP for device management, including PTZ preset configuration. The C500 v2.0 parses incoming SOAP requests containing preset-related XML elements and processes them against fixed-size stack-allocated arrays.

The core flaw is an unchecked element count. When an authenticated ONVIF client submits a request with a number of preset-related elements exceeding the capacity of the fixed-size stack array, the handler writes past the array boundary. Because the target buffer is located on the stack, the overflow corrupts adjacent stack memory — potentially including saved registers, return addresses, or other local variables — leading to a crash of the affected service. The CWE-121 classification (Stack-based Buffer Overflow) confirms the memory layout and write location.

Key characteristics of this vulnerability class and attack surface:

• Attack surface: The ONVIF SOAP interface, reachable over the network. The handler processes XML elements that map to preset operations. The number of elements in the request is the controlling input for the overflow.
• Authentication requirement: The NVD description states an authenticated ONVIF client is required. This means valid ONVIF credentials (or an established authenticated session) are a precondition. This raises the exploit complexity and lowers the CVSS PR metric relative to an unauthenticated defect.
• Primitive: The immediate observable effect is a service crash. The description does not indicate that the overflow is reliably exploitable for code execution; the stated impact is denial of service. No information is provided about whether stack canaries, ASLR, or other mitigations are present on the platform, so the exploitability for control-flow hijacking cannot be assessed from the available data.
• Precise element names, array identifiers, and handler function names are not disclosed in the NVD description. The description refers generically to "preset-related elements" and "fixed-size stack arrays." No further implementation detail should be assumed.

Insufficient technical detail is available to identify the specific array, its size, the exact XML schema element that controls the count, or whether the overflow is a linear copy or an indexed write.

Exploitation Scenarios

The following attack chain is inferred from the vulnerability class (CWE-121 in an ONVIF SOAP parser) and the NVD description. No public PoC is available; specific function names, endpoints, and element identifiers are not disclosed and must not be assumed.

1. Reconnaissance / target identification. An attacker identifies exposed TP-Link Tapo C500 v2.0 cameras. These devices expose ONVIF services over the network. Scanning for ONVIF endpoints (commonly the device management and PTZ service paths) using standard ONVIF discovery or port enumeration allows an attacker to locate candidate devices. Internet-exposed cameras are the primary risk group.

2. Authentication. The attacker obtains or possesses valid ONVIF credentials. This could come from default credentials left unchanged, credential reuse, prior compromise, or the attacker being an authorized-but-malicious insider. Without valid authentication the overflow cannot be triggered, per the description.

3. Triggering the flaw class. The authenticated attacker constructs a SOAP request to the PTZ service that includes an excessive number of preset-related elements. The handler iterates or copies these elements into a fixed-size stack buffer without validating the element count against the buffer capacity. The write proceeds past the end of the stack array, corrupting adjacent stack memory.

4. Payload/execution method (class level). At the vulnerability-class level, the "payload" is simply an over-long series of preset-related XML elements. The attacker does not need a complex payload to achieve DoS — the overflow itself causes memory corruption that crashes the service. Achieving control-flow hijack would require crafting the overwrite to control a return address, but the description does not establish that this is achievable, and no such exploit is known.

5. Post-exploitation impact. The affected service crashes. Camera management and PTZ-related functionality become unavailable. If the service does not auto-restart, the device may require a reboot. An attacker can repeat the request to keep the service down, producing a sustained denial of service against the camera's management and PTZ capabilities.

No public PoC, exploit code, or Nuclei template exists for this CVE. The attack chain above is derived strictly from the stated vulnerability class and required precondition (authenticated ONVIF client).

Impact Assessment

The impact is availability-focused. CVE-2026-104945 has no assigned CVSS score from NVD at the time of this report; the provisional vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects the described characteristics: network-reachable (AV:N), no special conditions beyond authentication (AC:L), requires authenticated ONVIF access (PR:L), no user interaction (UI:N), scope unchanged (S:U), no confidentiality or integrity impact described (C:N/I:N/A), and high availability impact (A:H) from service crash. This vector is a best-effort mapping and should be replaced by the authoritative NVD score when published.

Business impact:

• Physical security coverage gap. Tapo C500 cameras are commonly deployed for surveillance. Disrupting PTZ and management functionality can blind monitoring in the affected coverage area.
• Persistent disruption. The description states repeated exploitation can repeatedly disrupt camera management and PTZ-related functionality until the service recovers or restarts, meaning the attacker can sustain the outage.
• Blast radius. Any organization or individual operating exposed Tapo C500 v2.0 devices with ONVIF enabled and reachable by an authenticated client is affected. The precondition of authentication limits the population of remote unauthenticated attackers, but default/weak credentials and internal-network attackers significantly widen practical exposure.
• No data exfiltration or integrity impact is described. This is a DoS, not a confidentiality or ransomware-relevant vulnerability based on available data.

Detection Guidance

Sigma Rule

title: TP-Link Tapo C500 ONVIF PTZ Stack Overflow DoS Attempt
id: 9f3a1c2e-7b64-4d21-9a10-cve2026104945
status: experimental
description: Detects excessive preset-related elements in ONVIF PTZ SOAP requests targeting TP-Link Tapo C500 v2.0, consistent with CVE-2026-104945.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104945
author: valtersit.com
logsource:
  category: webserver
  product: onvif
detection:
  selection_method:
    cs-method: POST
  selection_path:
    cs-uri-stem|contains: '/onvif'
  selection_body:
    cs-body|contains: 'PTZ'
  selection_presets:
    cs-body|re: '(Preset|preset)'
  condition: selection_method and selection_path and selection_presets
  timeframe: 5m
falsepositives:
  - Legitimate ONVIF clients enumerating many presets
level: medium
tags:
  - attack.t1190
  - cve.2026.104945

YARA Rule

rule CVE_2026_104945_Tapo_C500_ONVIF_PTZ_Overflow
{
    meta:
        description = "Detects ONVIF PTZ SOAP requests containing an excessive number of preset elements indicative of CVE-2026-104945 against TP-Link Tapo C500 v2.0"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104945"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $onvif = "onvif" nocase
        $ptz   = "PTZ" nocase
        $preset = "Preset" nocase
        $soap = "soap" nocase

    condition:
        uint16(0) == 0x3C3F and   // starts with '<?'
        all of ($onvif, $soap, $ptz, $preset) and
        #preset > 50
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104945 TP-Link Tapo C500 ONVIF PTZ Preset Overflow Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/onvif"; nocase; http.header; content:"SOAPAction"; nocase; http.request_body; content:"PTZ"; nocase; http.request_body; content:"Preset"; nocase; pcre:"/(Preset|preset)([^\n]{0,200}){20,}/s"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-dos; reference:cve,2026-104945; sid:2026104945; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "POST" and
    http.request.body.text contains "onvif" and
    http.request.body.text contains "PTZ" and
    http.request.body.text contains "Preset" ]
  [ network where http.request.method == "POST" and
    http.request.body.text contains "onvif" and
    http.request.body.text contains "PTZ" ]

Splunk SPL Query

index=proxy OR index=network sourcetype=http_access
| where http_method="POST"
| where like(lower(uri), "%onvif%")
| where like(body, "%PTZ%") AND like(lower(body), "%preset%")
| eval preset_count = mvcount(split(body, "Preset"))
| where preset_count > 50
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip uri
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="onvif,camera,web,">
  <rule id="2026104" level="10">
    <if_sid>31100</if_sid>
    <match>onvif</match>
    <regex>PTZ.*[Pp]reset</regex>
    <description>CVE-2026-104945: Possible TP-Link Tapo C500 ONVIF PTZ preset overflow / DoS attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attempted_dos,cve_2026_104945,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, affected-version list, or workaround was provided in the tracked data.

1. Immediate mitigations

   • Disable or restrict the ONVIF service on Tapo C500 v2.0 devices where it is not required for operations. This removes the attack surface entirely.
   • Segment cameras onto a dedicated VLAN with strict egress/ingress filtering. Preclude direct internet exposure of the camera's ONVIF management interface; require access via VPN or a hardened reverse proxy.
   • Enforce unique, strong ONVIF credentials. Because exploitation requires authentication, eliminating default and weak credentials removes the practical path for most remote attackers.
   • Rate-limit and monitor ONVIF SOAP traffic; block clients submitting abnormally large PTZ preset payloads.
   • Where feasible, configure the device/platform to auto-restart the affected service to reduce outage duration from repeated crashes.

2. Patch / upgrade steps

   • No patch is currently available per tracked sources. Monitor TP-Link's official security advisory and firmware download pages for the Tapo C500 v2.0.
   • When firmware is released, update all affected devices promptly and verify the version after upgrade.
   • Until a fix exists, treat the ONVIF interface as untrusted and apply the mitigations above.

3. Long-term hardening

   • Maintain an inventory of IoT/camera assets and subscribe to TP-Link and CVE feeds for firmware advisories.
   • Adopt a policy prohibiting default credentials and requiring credential rotation on IP cameras.
   • Deploy network detection (the Suricata/Sigma/Splunk content above) to alert on anomalous ONVIF PTZ request volumes.
   • Isolate camera management planes from general corporate networks and monitor for unexpected service restarts, which may indicate crash-based exploitation.

References

• NVD — CVE-2026-104945: https://nvd.nist.gov/vuln/detail/CVE-2026-104945
• CWE-121 — Stack-based Buffer Overflow: https://cwe.mitre.org/data/definitions/121.html
• ONVIF Core Specification (PTZ service): https://www.onvif.org/profiles/specifications/
• TP-Link Security Advisories: https://www.tp-link.com/us/support/security-advisories/
• FIRST EPSS (not yet scored at time of writing): https://www.first.org/epss/

No threat actor campaigns, exploit-in-the-wild evidence, or public proof-of-concept were identified for CVE-2026-104945 in the available data. CISA KEV status: not listed.