CVE-2026-9032
Description
Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate that a password field is present for certain authentication and encryption parameter combinations, allowing a malformed request from the same local network to crash the HTTPS service Successful exploitation may temporarily make HTTPS management functions unavailable. Repeated malformed requests may sustain the denial-of-service condition, and recovery may in some cases require a device reboot.
How to fix
- TP-Link Systems Inc. Tapo C200 V5V5_1.4.6 Build 260709 Rel.27675n or later
- TP-Link Systems Inc. Tapo C120 V1V1_1.9.4 Build 260813 Rel.79754n or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| TP-Link Systems Inc. Tapo C200 V5 | v < V5_1.4.6 Build 260709 Rel.27675n | V5_1.4.6 Build 260709 Rel.27675n |
| TP-Link Systems Inc. Tapo C120 V1 | v < V1_1.9.4 Build 260813 Rel.79754n | V1_1.9.4 Build 260813 Rel.79754n |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.