CVE-2026-75618

Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reboot. Successful exploitation can disrupt live video streaming functionality and cause a temporary denial-of-service condition.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.tp-link.com/en/support/download/tapo-c100/#Firmware-Release-Notes	Release Notes
https://www.tp-link.com/us/support/download/tapo-c100/#Firmware-Release-Notes	Release Notes
https://www.tp-link.com/us/support/download/tapo-c101/#Firmware-Release-Notes	Release Notes
https://www.tp-link.com/us/support/faq/5251/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:tp-link:tapo_c100_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:tapo_c100:5.0:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:tp-link:tapo_c101_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:tp-link:tapo_c101:5.0:*:*:*:*:*:*:*

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Tapo C100/C101 V5 contiene una vulnerabilidad de desreferencia de puntero nulo en el servicio RTSP. Un atacante en la red local puede enviar solicitudes especialmente diseñadas que hacen que el servicio desreferencie un puntero no válido, lo que resulta en una caída del servicio y un reinicio del dispositivo. La explotación exitosa puede interrumpir la funcionalidad de transmisión de video en vivo y causar una condición temporal de denegación de servicio.

Information

Published : 2026-08-19 19:17

Updated : 2026-10-26 11:10

NVD link : CVE-2026-75618

Mitre link : CVE-2026-75618

CVE.ORG link : CVE-2026-75618

JSON object : View

Products Affected

tp-link

tapo_c100_firmware
tapo_c100
tapo_c101
tapo_c101_firmware

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2026-75618", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-75618", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T19:32:28.523402Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "affectedData": [{"vendor": "TP-Link Systems Inc.", "product": "Tapo C100 v5", "versions": [{"status": "affected", "version": "0", "lessThan": "1.5.4 Build 260528 Rel.11462n", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Tapo C101 v5", "versions": [{"status": "affected", "version": "0", "lessThan": "1.5.4 Build 260528 Rel.11462n", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-19T19:17:24.630", "references": [{"url": "https://www.tp-link.com/en/support/download/tapo-c100/#Firmware-Release-Notes", "tags": ["Release Notes"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/download/tapo-c100/#Firmware-Release-Notes", "tags": ["Release Notes"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/download/tapo-c101/#Firmware-Release-Notes", "tags": ["Release Notes"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/faq/5251/", "tags": ["Vendor Advisory"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reboot. Successful exploitation can disrupt live video streaming functionality and cause a temporary denial-of-service condition."}, {"lang": "es", "value": "Tapo C100/C101 V5 contiene una vulnerabilidad de desreferencia de puntero nulo en el servicio RTSP. Un atacante en la red local puede enviar solicitudes especialmente dise\u00f1adas que hacen que el servicio desreferencie un puntero no v\u00e1lido, lo que resulta en una ca\u00edda del servicio y un reinicio del dispositivo. La explotaci\u00f3n exitosa puede interrumpir la funcionalidad de transmisi\u00f3n de video en vivo y causar una condici\u00f3n temporal de denegaci\u00f3n de servicio."}], "lastModified": "2026-10-26T11:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tapo_c100_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EDB93E03-381A-4993-8244-4335BC3ABAF4", "versionEndExcluding": "1.5.4"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tapo_c100:5.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CD02A17C-9039-4376-867F-F8F300B94B48"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tapo_c101_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53291739-C959-4491-852C-5821D83A8D46", "versionEndExcluding": "1.5.4"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tapo_c101:5.0:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4AA495B0-AF30-4677-B8E7-842B13C3D0EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630"}