CVE-2026-104944 Unauthenticated TDP Function Pointer Dispatch Denial of Service in TP-Link Tapo C500
Unauthenticated attackers can crash the TP-Link Tapo C500 camera's TDP daemon via a malicious UDP packet, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-104944?
CVE-2026-104944 is a high-severity denial of service vulnerability in TP-Link Systems Inc. Tapo C500 v2.0, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in a denial-of-service condition.
Successful exploitation may allow an unauthenticated attacker with network access to the affected UDP service to repeatedly crash the TDP daemon, disrupting normal device operation and availability. No authentication, session establishment, or pairing is required to trigger the condition.
Weakness: CWE-823
Which versions are affected by CVE-2026-104944?
How do I fix CVE-2026-104944?
No fix has been published for CVE-2026-104944 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-104944 being exploited?
There is no known exploitation of CVE-2026-104944 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-hqfv-9fhw-44wc.