Rooting a Tapo camera through its Wi-Fi setup — CVE-2026-105810
An authenticated client on the local network overflows a 1024-byte stack buffer in the TP-Link Tapo C320WS onboarding path and gets a ROP chain to system() as root. The bug is one wrong length argument.