CVE-2026-6250

Katalog CVE

CVSS 8.1 · High EPSS 0,94%

Kerentanan Use of Externally-Controlled Format String pada tp-link tapo c110 firmware. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling of user-controlled input.  Externally controlled data is interpreted as a format string, which can be used to manipulate stack memory, including control flow data such as return addresses. A remote authenticated attacker may redirect execution flow to existing internal functions, triggering an unauthorized factory reset, leading to loss of configuration, deletion of stored credentials and service disruption.

Rincian

Terbit di NVD

11 Juni 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-134: Use of Externally-Controlled Format String

EPSS (30 hari)

0,94% peluang dieksploitasi; lebih tinggi dari 59,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.tp-link.com/us/support/faq/5128/ advisory vendor
• https://www.tp-link.com/en/support/download/tapo-c110/v2/#Firmware-Release-Notes release notes
• https://www.tp-link.com/kr/support/download/tapo-c110/v2/#Firmware-Release-Notes release notes
• https://www.tp-link.com/us/support/download/tapo-c110/v2/#Firmware-Release-Notes release notes