CVE-2026-104944

Description

TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in a denial-of-service condition. Successful exploitation may allow an unauthenticated attacker with network access to the affected UDP service to repeatedly crash the TDP daemon, disrupting normal device operation and availability. No authentication, session establishment, or pairing is required to trigger the condition.

Is your site exposed to CVE-2026-104944?

Run a free security scan — no signup, results in seconds.

Weakness Type (CWE)

CWE-823 CWE-823

References

Other References

https://www.tp-link.com/en/support/download/tapo-c500/#Firmware-Release-Notes https://www.tp-link.com/us/support/download/tapo-c500/#Firmware-Release-Notes https://www.tp-link.com/us/support/faq/5327/

Frequently Asked Questions

What is CVE-2026-104944? +

TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in a denial-of-service condition. Successful exploitation may allow an unauthenticated attacker with network access to the affected UDP service to repeatedly crash the TDP daemon, disrupting normal device operation and availability. No authentication, session establishment, or pairing is required to trigger the condition.

How do I check if I'm vulnerable to CVE-2026-104944? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2017-20211

UCanCode E-XD++ Visualization Enterprise Suite contains an untrusted pointer dereference vulnerability via the TKDRAWCAD.TKDrawCADCtrl.1 ActiveX control. This is because it …

CVE-2026-48977

OpenSlide is a C library for reading whole slide image files. From 3.4.1 until 4.0.1, OpenSlide's parse_level0_xml() processing in src/openslide-vendor-ventana.c …

CVE-2025-46806

A Use of Out-of-range Pointer Offset vulnerability in sslh leads to denial of service on some architectures.This issue affects sslh …

CVE-2026-102757

An unprivileged, memory-protected ThreadX module can have the kernel read and write memory at addresses of its choosing, in privileged …

CVE-2017-11076 9.8

On some hardware revisions where VP9 decoding is hardware-accelerated, the frame size is not programmed correctly into the decoder hardware …

CVE-2023-43553 9.8

Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.