CVE-2026-1871: Authenticated Stack-based Buffer Overflow in RTSP Authentication of Tapo C200

Synopsis

A stack-based buffer overflow exists in the RTSP authentication handler of the TP-Link Tapo C200 v5 IP camera. The flaw is reachable from an adjacent network (LAN, Wi-Fi, or VPN segment) without any credentials, by sending a crafted Authorization header that exceeds the expected field length. Successful exploitation crashes the RTSP core service and triggers an automatic device reboot, denying access to the live video stream and management interface until the service recovers. A patched-image rebuild at firmware version 1.4.4 Build 260527 Rel.28339n is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on the same adjacent network segment (local LAN, Wi-Fi subnet, or VPN) as the camera; remote internet-based exploitation is not possible with this vector.

• AuthenticationNot required

  No credentials are needed; the overflow is triggered during the authentication handshake itself, before any account validation occurs.

• Victim interactionNot required

  No user action is required; the attacker sends a crafted RTSP request directly to the device.

• Attack complexityDetail

  The exploit is reliable and condition-free, requiring no race conditions, memory layout knowledge, or other environmental preconditions.

Blast Radius

• Crashes the RTSP core service process on the camera, immediately terminating the live video stream for all connected viewers.
• Triggers an automatic full device reboot, cutting off access to both the video feed and the camera management interface for the duration of the restart cycle.
• Repeated exploitation keeps the device in a reboot loop, effectively taking the camera offline as a persistent denial-of-service condition.