This vulnerability (CWE-134) in TP-Link Tapo C110 v2's ONVIF service allows an authenticated attacker to supply externally controlled data interpreted as a format string. This can corrupt stack memory, including return addresses, enabling redirection of execution flow to internal functions. Exploitation can lead to an unauthorized factory reset, resulting in loss of device configuration, stored credentials, and disruption of service. The CVSS v4.0 base score is 7.0, indicating high severity. No patch or official remediation has been disclosed by the vendor as of the publication date.

Exploitation requires authentication but allows an attacker to forcibly reset the device to factory defaults. This results in loss of all configuration settings and stored credentials, causing service disruption and potential operational impact until the device is reconfigured.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the ONVIF service to trusted users only and monitor for suspicious authenticated activity. No official fix or temporary workaround has been published by the vendor at this time.