CVE-2026-75618
Medium
Description
Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reboot. Successful exploitation can disrupt live video streaming functionality and cause a temporary denial-of-service condition.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Tp-link Tapo C100 Firmware
PublishedAug 19, 2026
First seenAug 19, 2026
Weakness typeCWE-476NULL pointer dereference
How to fix
Update
- tp-link tapo_c100_firmware1.5.4 or later
- tp-link tapo_c101_firmware1.5.4 or later
Patches
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tp-link tapo_c100_firmware | v < 1.5.4 | 1.5.4 |
| tp-link tapo_c101_firmware | v < 1.5.4 | 1.5.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.