CVE-2026-6250: Authenticated Format String Injection on TP-Link Tapo C110

Synopsis

A format string injection vulnerability exists in the ONVIF service of the TP-Link Tapo C110 v2 firmware. A format string injection occurs when user-supplied input is passed directly to a formatting function, letting an attacker read or overwrite stack memory. An attacker on the same network segment who holds a valid account can exploit this to redirect execution flow into an internal factory-reset routine, wiping device configuration, deleting stored credentials, and disrupting service. A patched-image rebuild at firmware version 1.5.4 Build 260428 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be on an adjacent network such as a local LAN or VPN segment; the ONVIF service is not directly reachable from the open internet.

• AuthenticationRequired

  A valid account on the device is required; any low-privilege credential is sufficient to reach the vulnerable ONVIF code path.

• Victim interactionNot required

  No victim interaction is needed; the attacker sends a crafted request directly to the ONVIF service without any user participation.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or special environmental factors needed to trigger the format string.

Blast Radius

• Attacker overwrites stack memory including return addresses, redirecting execution flow to an internal factory-reset function.
• The factory reset wipes the device configuration, removing all stored credentials and custom settings.
• Service is disrupted as the device reboots into a default unconfigured state, breaking any dependent automation or monitoring integrations.
• Loss of stored credentials may expose downstream systems that relied on credentials held on the device.