Security Advisory: Authenticated Denial-of-Service Vulnerability in Tapo P110 (CVE-2026-15314)

Vulnerability and Impact Description:

CVE-2026-15314

Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient input validation before memory copy operations. This may lead to buffer overflow conditions, causing the web service process to crash.

Successful exploitation may cause the web service process to stop responding or restart, resulting in a denial-of-service condition.

CVSS v4.0 Score: 7.1 / High

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Products/Versions and Fixes:

Recommendations:

We strongly recommend that users with affected devices take the following actions:

1. Follow the instructions to update to the latest firmware version:

US: Download for Tapo P110 | TP-Link

EN: Download for Tapo P110 | TP-Link

Disclaimer:

This advisory is provided for informational purposes only and is subject to change without notice. The information is provided “as is” without warranties of any kind. TP-Link recommends that customers promptly apply available firmware updates or implement documented workarounds as provided in this advisory. Devices/systems that are not updated or mitigated as described may remain vulnerable, and TP-Link disclaims any responsibility or liability for any damages or losses arising from a failure to implement such updates.