Description
An
unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the
RTSP streaming service on TCP port 554 when the Camera Account feature is
enabled. A crafted pair of RTSP-over-HTTP tunneling requests can cause memory
corruption and crash the streaming daemon. 









Successful
exploitation may allow an unauthenticated adjacent-network attacker to disrupt
live video and related streaming functions until the affected service recovers
or restarts.
Published: 2026-10-08
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service: Crashing RTSP daemon
Action: Apply Patch
AI Analysis

Impact

An unauthenticated denial‑of‑service vulnerability exists in the RTSP streaming service on TCP port 554 of TP‑Link Tapo C325WB v2 when the Camera Account feature is enabled. A crafted pair of RTSP‑over‑HTTP tunneling requests can lead to memory corruption that crashes the streaming daemon, causing loss of live video and related streaming functions until the service recovers or restarts.

Affected Systems

TP‑Link Systems Inc. Tapo C325WB v2 is affected; firmware version v2 of this camera model is vulnerable. No other versions or products are listed.

Risk and Exploitability

The CVSS base score of 7.1 indicates a high‑severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers who are unauthenticated but on the same local network can exploit it by sending specific RTSP‑over‑HTTP tunneling requests to port 554. Successful exploitation would temporarily halt live video, making the device unusable until the daemon restarts.

Generated by OpenCVE AI on October 8, 2026 at 23:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the camera firmware to the latest version released by TP‑Link that contains the fix.
  • Disable the Camera Account feature if it is not required for operation.
  • Restrict access to TCP port 554 by configuring network firewalls or segmentation to allow only trusted devices.
  • Monitor the device for unexpected service crashes and verify that the daemon has recovered after an incident.

Generated by OpenCVE AI on October 8, 2026 at 23:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 09 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Tp-link
Tp-link tapo C325wb V2
Vendors & Products Tp-link
Tp-link tapo C325wb V2

Thu, 08 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Description An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Account feature is enabled. A crafted pair of RTSP-over-HTTP tunneling requests can cause memory corruption and crash the streaming daemon.  Successful exploitation may allow an unauthenticated adjacent-network attacker to disrupt live video and related streaming functions until the affected service recovers or restarts.
Title Unauthenticated RTSP Tunnel Denial-of-Service Vulnerability in TP-Link Tapo C325WB
Weaknesses CWE-121
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Tp-link Tapo C325wb V2
cve-icon MITRE

Status: PUBLISHED

Assigner: TPLink

Published:

Updated: 2026-10-09T15:18:26.003Z

Reserved: 2026-10-05T17:48:05.161Z

Link: CVE-2026-105673

cve-icon Vulnrichment

Updated: 2026-10-09T15:18:21.590Z

cve-icon NVD

Status : Deferred

Published: 2026-10-08T23:16:57.520

Modified: 2026-10-09T17:07:31.693

Link: CVE-2026-105673

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T08:02:24Z

Weaknesses
  • CWE-121

    Stack-based Buffer Overflow