The HTTP parser in TP‑Link Tapo C210 v3, Tapo C220 v1, and Tapo C520WS v2 cameras mishandles requests containing an excessively long URL path. An invalid‑URL error path propagates into cleanup code that assumes allocated buffers exist, leading to a crash and service restart. The flaw allows any unauthenticated user to repeatedly trigger service restarts or device reboots, resulting in denial of service. The underlying weakness is improper bounds checking and buffer handling, as identified by CWE‑20.

TP‑Link Systems Inc. devices Tapo C210 v3, Tapo C220 v1, and Tapo C520WS v2 are affected. The vulnerability applies to the firmware packages listed for each model on TP‑Link’s support site and is present in firmware versions before the latest publicly available release.

The CVSS score of 7.1 indicates a high impact severity, while the EPSS score of less than 1% suggests a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. An attacker can exploit it remotely by sending crafted HTTP requests to the web interface of any affected device without authentication, causing the device to crash or reboot repeatedly. No additional pre‑conditions are required beyond network reachability to the camera’s web service.