CVE-2026-9032
HighCVSS 7.1Summary
Tapo C120 v1 and C200 v5 cameras have a NULL pointer dereference vulnerability in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate the presence of a password field for certain parameter combinations, allowing a malformed request from the local network to crash the HTTPS service.
Risk Assessment
An attacker on the same local network can temporarily disable HTTPS management functions, and repeated attacks may lead to persistent DoS requiring device reboot.
Recommendation
Apply firmware updates from the vendor if available, or restrict access to the HTTPS interface from trusted networks.
Other vulnerabilities in Tapo C120/C200
See all- CVE-2026-78578High
Tapo C120 v1 and C200 v5 cameras do not enforce authentication for HTTPS onboarding connect actions after initial setup. An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection to a different network.
- CVE-2026-78577Medium
Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, an unauthenticated attacker on the same local network can invoke the scan action and retrieve nearby wireless access-point metadata, including SSIDs, BSSIDs, authentication and encryption modes, and signal-strength information.
- CVE-2026-15315High
Tapo C120 v1 and C200 v5 cameras contain an improper authentication vulnerability in the login authentication verification module. An attacker on the local network can exploit weaknesses in challenge parameter validation to bypass normal authentication controls and obtain administrative session tokens. This may allow privileged management actions, unauthorized administrative access, and temporary disruption of device services (DoS).
Original NVD description (English source)
Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate that a password field is present for certain authentication and encryption parameter combinations, allowing a malformed request from the same local network to crash the HTTPS service Successful exploitation may temporarily make HTTPS management functions unavailable. Repeated malformed requests may sustain the denial-of-service condition, and recovery may in some cases require a device reboot.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS