{"id":"CVE-2026-104944","state":"PUBLISHED","title":"Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500","description":"TP-Link Tapo\nC500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP\n(TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can\ncause an invalid indirect call, crashing the main service and resulting in a\ndenial-of-service condition.\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated attacker with network access to the\naffected UDP service to repeatedly crash the TDP daemon, disrupting normal\ndevice operation and availability. No authentication, session establishment, or\npairing is required to trigger the condition.","publishedAt":"2026-10-06T18:40:58.935Z","updatedAt":"2026-10-07T14:02:34.899Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"TPLink"},"assigner":"TPLink","products":["TP-Link Systems Inc. Tapo C500 v2.0"],"affected":[{"vendor":"TP-Link Systems Inc.","product":"Tapo C500 v2.0","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.3.5 Build 260810","versionType":"custom"}]}],"references":["https://www.tp-link.com/us/support/download/tapo-c500/#Firmware-Release-Notes","https://www.tp-link.com/en/support/download/tapo-c500/#Firmware-Release-Notes","https://www.tp-link.com/us/support/faq/5327/"],"weaknesses":["CWE-823"],"ingestedAt":"2026-10-29T20:10:23.711Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/104xxx/CVE-2026-104944.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-104944","state":"PUBLISHED","datePublished":"2026-10-06T18:40:58.935Z","dateUpdated":"2026-10-07T14:02:34.899Z","assignerShortName":"TPLink","assignerOrgId":"f23511db-6c3e-4e32-a477-6aa17d310630","dateReserved":"2026-10-02T17:39:50.435Z"},"containers":{"cna":{"title":"Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500","descriptions":[{"lang":"en","value":"TP-Link Tapo\nC500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP\n(TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can\ncause an invalid indirect call, crashing the main service and resulting in a\ndenial-of-service condition.\n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated attacker with network access to the\naffected UDP service to repeatedly crash the TDP daemon, disrupting normal\ndevice operation and availability. No authentication, session establishment, or\npairing is required to trigger the condition."}],"affected":[{"vendor":"TP-Link Systems Inc.","product":"Tapo C500 v2.0","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.3.5 Build 260810","versionType":"custom"}]}],"references":[{"url":"https://www.tp-link.com/us/support/download/tapo-c500/#Firmware-Release-Notes","tags":["patch"]},{"url":"https://www.tp-link.com/en/support/download/tapo-c500/#Firmware-Release-Notes","tags":["patch"]},{"url":"https://www.tp-link.com/us/support/faq/5327/","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":7.1,"vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-823","lang":"en","description":"CWE-823 Use of out-of-range pointer offset","type":"CWE"}]}],"providerMetadata":{"shortName":"TPLink","orgId":"f23511db-6c3e-4e32-a477-6aa17d310630","dateUpdated":"2026-10-06T18:40:58.935Z"},"impacts":[{"capecId":"CAPEC-100","descriptions":[{"lang":"en","value":"CAPEC-100 Overflow Buffers"}]}],"credits":[{"lang":"en","value":"Anastasios Kaltakis","type":"finder"}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.5"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-07T14:02:17.137504Z","id":"CVE-2026-104944","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-07T14:02:34.899Z"}}]}}}