CVE-2023-41184 is a stack-based buffer overflow in the ActiveCells parameter of the CreateRules and ModifyRules APIs, rated High (CVSS 8.0). It affects Tapo C210 IP camera. The fix is firmware 1.3.6 Build 230426 Rel.48373n, so update and check the vendor advisory for your build. ZDI published the report as ZDI-23-1287.
What's affected
The record lists the TP-Link Tapo C210 hardware version v2 with firmware 1.3.0. ZDI says the issue is fixed in firmware 1.3.6 Build 230426 Rel.48373n and points to the TP-Link firmware release notes for the Tapo C210.
I could not load those release notes in a form that shows the version history, so confirm the fixed build on the TP-Link download page for your hardware version.
Scores disagree. The NVD record gives 8.0 with vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. ZDI, which reported the bug, scores it 6.8.
The difference comes from how each side rates attack requirements and scope. Plan against the higher of the two numbers until you have a reason not to.
How to check if you're exposed
In the Tapo app or the camera web interface, read the firmware version for each C210 and compare it with 1.3.6 Build 230426 Rel.48373n. The record names hardware version v2 on firmware 1.3.0.
Then think about who shares a network with the camera. The record marks this as network-adjacent, so a camera on the same Wi-Fi or VLAN as guests or untrusted devices is the higher risk.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan. It covers application dependencies, so it will not see embedded device firmware. Track devices like this in your hardware inventory instead.
What to do now
- Record the firmware version on every Tapo C210.
- Update to 1.3.6 Build 230426 Rel.48373n or later, and confirm the build on the TP-Link release notes.
- Keep cameras on their own network, away from guest devices.
- Replace the camera password if it is shared or weak.
Hardening steps that go beyond the advisory, such as network segmentation, are general practice and not vendor guidance for this CVE.
Why it matters
The weakness class is CWE-121 and CWE-787: a stack-based buffer overflow, which is an out-of-bounds write. The advisory says the length of user-supplied data is not checked before it is copied into a fixed-length stack buffer.
Memory corruption bugs like this in network-facing code tend to come in families, because the same unchecked copy is repeated across parameters. That is why a single advisory lists many CVEs for one product.
The CISA Known Exploited Vulnerabilities flag is false for this CVE, and none of the pages I read say it is exploited in the wild. That is not a reason to wait, only a note on urgency.
Quick check
Does this need a login?
The advisory says authentication is required, but that the existing mechanism can be bypassed. Treat the camera as exposed to anyone on its network until it is updated.
Sources
- NVD-derived record data and Safeguard Gold entry for CVE-2023-41184
- Zero Day Initiative advisory ZDI-23-1287
Last reviewed: 19 October 2026.
