High severity · published Aug 4, 2026
CVE-2026-15314
Authenticated Denial-of-Service Vulnerability in TP-Link Tapo P110
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
Tapo P110 v1
smart Wi-Fi Plug contains an improper boundary validation vulnerability in the
handling of authenticated HTTP request bodies due to insufficient input
validation before memory copy operations. This may lead to buffer overflow condition,
causing the web service process to crash.
Successful exploitation
may cause the web service process to stop responding or restart, resulting in a
denial-of-service condition.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PV
P110 v1 · TP-Link Systems Inc.
before V1_1.1.4 Build 260709 · source: vendor
TP
Tapo P110 Firmware · Tp-link
before 1.1.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-15314
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-15314
Release Notes
https://www.tp-link.com/en/support/download/tapo-p110/v1/#Firmware-Release-Notes
Release Notes
https://www.tp-link.com/us/support/download/tapo-p110/v1/#Firmware-Release-Notes
Vendor Advisory
https://www.tp-link.com/us/support/faq/5220/
