TP‑Link Tapo C200 v5 stores the contents of the RTSP Authorization header without proper bounds checking, creating a stack‑based buffer overflow. An attacker who can send a crafted authentication request can cause the RTSP core service to crash, forcing the camera to reboot and preventing access to the live stream or management interface until service recovery.

The vulnerability afflicts the TP‑Link Tapo C200 model v5. Users of this camera model, including home and small‑business deployments, are exposed when the device is reachable over the network and RTSP credentials are present.

The flaw merits a CVSS score of 7.1, indicating high severity. The EPSS score is unavailable, and the issue is not listed in CISA’s KEV catalog. Exploitation requires authentic credentials for the RTSP service, implying an authenticated attacker. Once authenticated, the attacker can trigger a reboot-induced denial of service. The absence of a public exploit at this time reduces immediate risk, but the high severity and lack of a mitigation in the vendor firmware warrant swift action.