Technical impact
A null‑pointer dereference occurs in the HTTP service of the Tapo C100 v5, Tapo C220 v1, and Tapo C520WS v2 cameras when the device receives a POST request containing an excessively large Content‑Length header. The resulting failed memory allocation triggers a crash of the main service process, temporarily disabling the camera’s HTTP interface. This is a CWE‑476 vulnerability. An unauthenticated attacker can repeatedly trigger this failure, causing a denial of service until the device automatically restarts.
Affected Systems
The vulnerability affects TP‑Link Tapo C100 v5, Tapo C220 v1, and Tapo C520WS v2 models. These are firmware devices that expose a HTTP service for configuration and video access. The issue is present in the firmware versions cited in the vendor’s support links, and the data does not indicate that current firmware updates mitigate the problem.
Risk and Exploitability
The CVSS base score of 7.1 reflects a high severity vulnerability. The EPSS score is below 1 %, indicating that the likelihood of exploitation is low, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is network‑based; any host that can reach the camera’s HTTP port can send a malicious POST request. No authentication is required, so the vulnerability can be abused by anyone with network access to the camera, leading to repeated service restarts and temporary denial of service.
