> CVE-2025-8065: TP-Link ONVIF stack buffer overflow

An attacker sending a malformed ONVIF request over LAN to a TP-Link Smart camera device can trigger the vulnerability described here. This report describes a stack buffer overflow, which leads to pre-auth remote code execution via LAN or WAN (through browser). The vulnerability we are disclosing in this advisory affected a wide range of TP-Link devices, including TAPO Smart Cameras. A TP-Link Security Advisory originally released in December 2026 and updated in April 2026 contains this vulnerability as CVE-2025-8065. Vulnerability Details In the ONVIF stack there is a bug in the SOAP parser in the soap_rearrange_tag function. soap_rearrange_tag(char* src_tag, char* dst_tag) { char ns[16]; // .