TP‑Link Tapo C500 v2.0 has an out‑of‑bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An attacker who has authenticated access to the ONVIF interface can submit an excessive number of preset‑related elements. This causes writes beyond the bounds of fixed‑size stack arrays, leading the service to crash. The crash results in a denial‑of‑service condition for camera management and PTZ functionality.

The affected product is the TP‑Link Tapo C500 running firmware version 2.0. No other versions or hardware variants are listed as affected in the advisories provided.

The vulnerability has a CVSS score of 6.8, indicating a moderate severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified, and the issue is not listed in the CISA KEV catalog. The attack vector requires authenticated access to the ONVIF service, meaning the attacker must first gain valid credentials or otherwise authenticate to the device. If successful, repeated exploitation will repeatedly crash the service, causing persistent denial of service until the device is restarted or the service recovers.