Description
Tapo C120 v1 and C200 v5
contain a NULL pointer dereference in the HTTPS onboarding connect request parser.  The interface is reachable without
authentication after initial setup and does not validate that a password field
is present for certain authentication and encryption parameter combinations,
allowing a malformed request from the same local network to crash the HTTPS service










 Successful exploitation may
temporarily make HTTPS management functions unavailable. Repeated malformed
requests may sustain the denial-of-service condition, and recovery may in some
cases require a device reboot.
Published: 2026-10-01
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch ASAP
AI Analysis

Impact

The vulnerability is a null pointer dereference that occurs in the HTTPS onboarding connect request parser of the TP‑Link Tapo C120 and C200 devices. It allows an unauthenticated user on the same local network to send a malformed request that crashes the HTTPS service, temporarily rendering management functions unavailable. Repeated exploitation can sustain the denial‑of‑service condition and may force a device reboot for recovery.

Affected Systems

TP‑Link Systems Inc. devices, specifically the Tapo C120 V1 firmware and the Tapo C200 V5 firmware. The related firmware release notes for version 1.26 (C120) and version v5 (C200) include patches for this issue.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity, and while an EPSS score is not provided, the vulnerability can be exploited with no authentication from a local network, making it relatively easy to trigger. It is not listed in CISA’s KEV catalog. Because the attacker can cause the HTTPS service to crash repeatedly, the risk of extended downtime is significant, especially in environments where continuous remote management is required.

Generated by OpenCVE AI on October 1, 2026 at 18:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the device firmware to the latest version (1.26 for Tapo C120 and v5 for Tapo C200) as published by TP‑Link.
  • Restrict access to the device’s HTTPS management interface by configuring network firewall rules or isolating the device on a separate VLAN to limit exposure to local network traffic.
  • If a crash occurs, perform an immediate reboot of the device to restore service readiness and monitor device logs for further malformed requests to detect ongoing exploitation attempts.

Generated by OpenCVE AI on October 1, 2026 at 18:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 07 Oct 2026 06:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
First Time appeared Tp-link
Tp-link tapo C120 V1
Tp-link tapo C200 V5
Vendors & Products Tp-link
Tp-link tapo C120 V1
Tp-link tapo C200 V5

Thu, 01 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Description Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser.  The interface is reachable without authentication after initial setup and does not validate that a password field is present for certain authentication and encryption parameter combinations, allowing a malformed request from the same local network to crash the HTTPS service  Successful exploitation may temporarily make HTTPS management functions unavailable. Repeated malformed requests may sustain the denial-of-service condition, and recovery may in some cases require a device reboot.
Title Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerability in TP-Link Tapo C120 & C200
Weaknesses CWE-476
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Tp-link Tapo C120 V1 Tapo C200 V5
cve-icon MITRE

Status: PUBLISHED

Assigner: TPLink

Published:

Updated: 2026-10-06T18:02:10.874Z

Reserved: 2026-05-19T16:30:36.090Z

Link: CVE-2026-9032

cve-icon Vulnrichment

Updated: 2026-10-02T13:52:34.419Z

cve-icon NVD

Status : Deferred

Published: 2026-10-01T18:17:29.390

Modified: 2026-10-06T19:18:18.800

Link: CVE-2026-9032

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T19:33:18Z

Weaknesses