CVE-2026-15314 is a high severity buffer overflow (CVSS 7.5) in the TP-Link Tapo P110 v1 smart Wi-Fi plug. Authenticated HTTP request bodies are copied without enough validation, which can crash the web service. TP-Link's fixed firmware is V1_1.1.4 Build 260709.
What's affected
- TP-Link Tapo P110, hardware version V1, on firmware earlier than the fix.
- Fixed: V1_1.1.4 Build 260709, per TP-Link's FAQ. Use the latest firmware from the Tapo P110 V1 download page.
- Mitigation: update. TP-Link lists no other workaround.
- Effect: the web service stops responding or restarts, a denial of service.
Source conflict on severity: the CVE record scores this 7.5 High (vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, no privileges). TP-Link's FAQ gives CVSS 4.0 of 7.1, High. The description says authenticated request bodies, while the record's vector lists no privileges required, which is another small difference worth knowing.
How to check if you're exposed
Open the Tapo app, select the plug, and check the firmware version in the device settings. Compare it with V1_1.1.4 Build 260709. Check the hardware version printed on the device label too, since the advisory covers V1 only.
If you manage many plugs, keep a list of model, hardware version and firmware. Consumer devices on a flat home or office network are easy to forget, and they share the network with more valuable machines.
What to do now
- Identify every Tapo P110 and its hardware version.
- Update V1 plugs to firmware V1_1.1.4 Build 260709 or later using the Tapo app or TP-Link's download page.
- Put smart plugs on a separate network segment from workstations and servers.
- Replace devices that no longer receive firmware updates.
Why it matters
The record classes this as CWE-120 (Buffer Copy without Checking Size of Input), the classic buffer overflow. Insufficient validation happens before a memory copy, so an oversized request body writes past a buffer. In this case the advisory describes the outcome as a crash of the web service, not code execution.
The danger is modest for one plug, but it is a good reminder that small devices run network services written in memory unsafe languages. The practical risk is availability, and it needs a network path to the device. The record does not list the CVE as exploited, and it is not in the CISA KEV catalog.
Devices like smart plugs rarely appear in asset inventories, yet they sit on the same network as everything else. Put them in a separate VLAN or guest network, so that a flaw in a cheap device does not become a foothold toward your laptops and servers.
Quick check
Does it affect every P110?
Only hardware version V1, per TP-Link's FAQ.
Does it allow code execution?
The advisory describes a crash or restart of the web service, a denial of service.
Sources
Last reviewed: 18 October 2026.
