CVE-2026-105673

High

Description

An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Account feature is enabled. A crafted pair of RTSP-over-HTTP tunneling requests can cause memory corruption and crash the streaming daemon. Successful exploitation may allow an unauthenticated adjacent-network attacker to disrupt live video and related streaming functions until the affected service recovers or restarts.

SeverityHigh

CVSS7.1

Exploit probability18. percentile0.3%

ProductTapo C325WB v2

PublishedOct 8, 2026

First seenOct 8, 2026

Weakness typeCWE-121CWE-121

How to fix

Update

TP-Link Systems Inc. Tapo C325WB v2V2_1.3.3 Build 260914 or later

Patches

Vendor advisories

tp-link.com/us/support/faq/5333/

Affected products

Product	Affected versions	Fixed in
TP-Link Systems Inc. Tapo C325WB v2	v < V2_1.3.3 Build 260914	V2_1.3.3 Build 260914

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.