TP Link Systems Inc. Tapo C100 V5 vulnerabilities

3 vulnerabilities

Known vulnerabilities in TP Link Systems Inc. Tapo C100 V5, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.5CVE-2026-0918tp-link systems inc.tapo c100 v5+4
EPSS score
0.73%
The Tapo C100 v5, C220 v1 and C520WS v2 cameras’ HTTP service does not safely handle POST requests containing an excessively large Content-Length header. The resulting failed memory allocation triggers a NULL pointer dereference, causing the main service process to crash. An unauthenticated attacker can repeatedly crash the service, causing temporary denial of service. The device restarts automatically, and repeated requests can keep it unavailable.6.9CVE-2026-75619tp-link systems inc.tapo c100 v5+3
EPSS score
0.41%
Tapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, resulting in out-of-bounds heap writes. Successful exploitation can crash the RTSP service and trigger a device reboot, resulting in a temporary denial-of-service condition.7.1CVE-2026-75618tp-link systems inc.tapo c100 v5+3
EPSS score
0.38%
Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reboot. Successful exploitation can disrupt live video streaming functionality and cause a temporary denial-of-service condition.