Description
The Tapo C100 v5, C220 v1 and C520WS v2 cameras’ HTTP service does not safely handle POST requests containing an excessively large Content-Length header. The resulting failed memory allocation triggers a NULL pointer dereference, causing the main service process to crash. An unauthenticated attacker can repeatedly crash the service, causing temporary denial of service. The device restarts automatically, and repeated requests can keep it unavailable.
References (7)
Scores
CVSS v3
7.5
EPSS
0.0003
EPSS Percentile
10.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-476
Status
published
Products (5)
tp-link/tapo_c220_firmware
< 1.4.2
tp-link/tapo_c520ws_firmware
< 1.2.3
TP-Link Systems Inc./Tapo C100 v5
< 1.4.3 Build 251128
TP-Link Systems Inc./Tapo C220 v1
< 1.4.2 Build 251112
TP-Link Systems Inc./Tapo C520WS v2
< 1.2.3 Build 251114
Published
Jan 27, 2026
Tracked Since
Feb 18, 2026