CVE-2026-0919highCWE-20

CVE-2026-0919: falha de alta gravidade em TP Link Systems Inc. Tapo C210 v3

Unauthenticated Denial of Service via Oversized URL in HTTP Parser on TP-Link Tapo C210, C220 & C520WS

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Tapo C520WS+ Monitorar Tapo C210

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.1epss 0.6%
The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively long URL path. An invalid‑URL error path continues into cleanup code that assumes allocated buffers exist, leading to a crash and service restart. An unauthenticated attacker can force repeated service crashes or device reboots, causing denial of service.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
TP Link Systems Inc. · Tapo C210 v3TP-Link Systems Inc. · Tapo C220 v1TP-Link Systems Inc. · Tapo C520WS v2
CVEs relacionadas — TP Link Systems Inc. Tapo C210 v3

No mesmo produto, das mais perigosas para as menos.

CVE-2026-0918HIGHNull Pointer Dereference in Tapo SmartCam HTTP Service on TP-Link Tapo C220 & C520WSEPSS 0.7%CVE-2026-1315HIGHUnauthenticated Denial of Service via Firmware Update Endpoint on TP-Link Tapo C220 & C520WSEPSS 0.6%CVE-2026-34118HIGHHeap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in multiple TP-Link Tapo CamerasEPSS 0.5%CVE-2026-8714HIGHDenial-of-Service Vulnerability in RTSP Input Handling on TP-Link's Tapo C520WSEPSS 0.2%CVE-2026-6240MEDIUMAuthenticated Stack-based Buffer Overflow in ONVIF DeleteUsers Service on TP-Link Tapo C520WSEPSS 0.2%CVE-2026-6239MEDIUMAuthenticated Stack-based Buffer Overflow in ONVIF CreateUsers Service in TP-Link Tao C520WSEPSS 0.2%