Dashboard / CVE-2026-6250

CVE-2026-6250

HIGH
MEDIUM Priority: 0.03 BB Relevance: 49/100
Published: 2026-06-11 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Adjacent Low Complexity No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Adjacent
AC: Low
PR: Low
UI: None
S: X
AT: None
VC: None
VI: High
VA: High

Description

An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling of user-controlled input.  Externally controlled data is interpreted as a format string, which can be used to manipulate stack memory, including control flow data such as return addresses. A remote authenticated attacker may redirect execution flow to existing internal functions, triggering an unauthorized factory reset, leading to loss of configuration, deletion of stored credentials and service disruption.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
tp-link tapo_c110_firmware < 1.5.4

References & Advisories (4)

Bug Bounty Relevance

49 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

7.0 / 10.0 v4.0
CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.46%
Raw Score 0.004630
Percentile 40.1%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00463
2026-10-28
0.00463

Intelligence Sources

nvd ref →

External Links