CVE-2026-6250 — Authenticated Format String Injection on TP-Link Tapo C110
An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling of user-controlled input. Externally controlled data is interp…
Published: 2026-06-11 · CVSS: 7.0 · CVSS 4.0
An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling of user-controlled input. Externally controlled data is interpreted as a format string, which can be used to manipulate stack memory, including control flow data such as return addresses. A remote authenticated attacker may redirect execution flow to existing internal functions, triggering an unauthorized factory reset, leading to loss of configuration, deletion of stored credentials and service disruption.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7