CVE-2026-0918highCWE-476

CVE-2026-0918: high-severity vulnerability in TP-Link Systems Inc. Tapo C100 v5

Null Pointer Dereference in Tapo SmartCam HTTP Service on TP-Link Tapo C220 & C520WS

Published · Updated

Follow this CVE+ Monitor Tapo C520WS+ Monitor Tapo C100

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.7%
The Tapo C100 v5, C220 v1 and C520WS v2 cameras’ HTTP service does not safely handle POST requests containing an excessively large Content-Length header. The resulting failed memory allocation triggers a NULL pointer dereference, causing the main service process to crash. An unauthenticated attacker can repeatedly crash the service, causing temporary denial of service. The device restarts automatically, and repeated requests can keep it unavailable.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
TP-Link Systems Inc. · Tapo C100 v5TP-Link Systems Inc. · Tapo C220 v1TP-Link Systems Inc. · Tapo C520WS v2
Related CVEs — TP-Link Systems Inc. Tapo C100 v5

In the same product, most dangerous first.

CVE-2026-1315HIGHUnauthenticated Denial of Service via Firmware Update Endpoint on TP-Link Tapo C220 & C520WSEPSS 0.6%CVE-2026-0919HIGHUnauthenticated Denial of Service via Oversized URL in HTTP Parser on TP-Link Tapo C210, C220 & C520WSEPSS 0.6%CVE-2026-75619MEDIUMRTSP Heap Buffer Overflow Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101EPSS 0.4%CVE-2026-75618HIGHRTSP Null Pointer Dereference Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101EPSS 0.4%CVE-2026-8714HIGHDenial-of-Service Vulnerability in RTSP Input Handling on TP-Link's Tapo C520WSEPSS 0.2%CVE-2026-6240MEDIUMAuthenticated Stack-based Buffer Overflow in ONVIF DeleteUsers Service on TP-Link Tapo C520WSEPSS 0.2%