Vulnerabilities

TI-2026-01028 CVE-2026-1315 · GHSA-g9c2-p6j5-8cv4

Unauthenticated Denial of Service via Firmware Update Endpoint on TP-Link Tapo C220 & C520WS

LOW 32

By sending crafted files to the firmware update endpoint of Tapo C220 v1 and C520WS v2, the device terminates core system services before verifying authentication or firmware integrity.

CVSS 4.0HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00632 Published 2026-01-27 Fixed in 1.4.2 Build 251112, 1.2.3 Build 251114 CWE-20

TI-2026-00695 CVE-2026-0919 · GHSA-7ff9-hxc6-hrqm

Unauthenticated Denial of Service via Oversized URL in HTTP Parser on TP-Link Tapo C210, C220 & C520WS

LOW 32

The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively long URL path.

CVSS 4.0HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00606 Published 2026-01-27 Fixed in 1.4.2 Build 251112, 1.2.3 Build 251114 +1 CWE-20

TI-2026-00694 CVE-2026-0918 · GHSA-ffwx-rgqv-xv4m

Null Pointer Dereference in Tapo SmartCam HTTP Service on TP-Link Tapo C220 & C520WS

LOW 32

The Tapo C100 v5, C220 v1 and C520WS v2 cameras’ HTTP service does not safely handle POST requests containing an excessively large Content-Length header.

CVSS 4.0HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00722 Published 2026-01-27 Fixed in 1.4.2 Build 251112, 1.2.3 Build 251114 +1 CWE-476

Vulnerabilities

Filters

Unauthenticated Denial of Service via Firmware Update Endpoint on TP-Link Tapo C220 & C520WS

Unauthenticated Denial of Service via Oversized URL in HTTP Parser on TP-Link Tapo C210, C220 & C520WS

Null Pointer Dereference in Tapo SmartCam HTTP Service on TP-Link Tapo C220 & C520WS