An authenticated format string vulnerability was discovered in the ONVIF service of TP‑Link Tapo C110 v2. Improper handling of user‑controlled input allows crafted data to be interpreted as a format string, enabling manipulation of stack memory, including return addresses. An attacker can redirect execution flow to internal functions, which can trigger an unauthorized factory reset and result in loss of configuration, deletion of stored credentials, and service disruption.

The flaw affects TP‑Link Systems Inc. Tapo C110 v2 devices. No more specific versioning is provided; all units that ship with the v2 firmware are considered vulnerable.

The CVSS base score of 7 indicates a high severity vulnerability. EPSS information is not available and the issue is not listed in CISA’s KEV catalog, so no large‑scale exploitation has yet been reported. Exploitation requires authenticated access to the ONVIF service; once compromised, the attacker can gain remote code execution capable of forcing a factory reset. The potential impact on confidentiality, integrity and availability is significant, resulting in a moderate to high risk for devices exposed to external networks.