CVE-2026-9032
HIGH
7,1
Source: f23511db-6c3e-4e32-a477-6aa17d310630
Attack Vector: adjacent
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
Description
AI Translation Available
Tapo C120 v1 and C200 v5
contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without
authentication after initial setup and does not validate that a password field
is present for certain authentication and encryption parameter combinations,
allowing a malformed request from the same local network to crash the HTTPS service
Successful exploitation may
temporarily make HTTPS management functions unavailable. Repeated malformed
requests may sustain the denial-of-service condition, and recovery may in some
cases require a device reboot.
476
NULL Pointer Dereference
StableCommon Consequences
Security Scopes Affected:
Availability
Integrity
Confidentiality
Potential Impacts:
Dos: Crash, Exit, Or Restart
Execute Unauthorized Code Or Commands
Read Memory
Modify Memory
Applicable Platforms
Languages:
C, C++, Java, C#, Go
https://www.tp-link.com/en/support/download/tapo-c120/v1.26/#Firmware-Release-N…
https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes
https://www.tp-link.com/us/support/download/tapo-c120/v1.26/#Firmware-Release-N…
https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes
https://www.tp-link.com/us/support/faq/5321/