TP-Link Tapo C210 ActiveCells Stack-based Buffer Overflow Remote Code Execution Vulnerability

CVE-2023-41184

Summary

The TP-Link Tapo C210 IP camera contains a significant stack-based buffer overflow vulnerability within its ActiveCells parameter handling in the CreateRules and ModifyRules APIs. This flaw arises from inadequate validation of user-supplied data lengths, which may allow an attacker to exploit the vulnerability by executing arbitrary code on affected devices. Although an authentication step is required, the effectiveness of existing mechanisms can be compromised, enabling attackers to perform code execution in the context of root privileges. As a result, users are prompted to ensure that their devices are adequately secured against potential exploitation. Detailed advisory can be found on the Zero Day Initiative's website.

References