Security Advisory on Multiple Vulnerabilities on Tapo C220 and C520WS (CVE-2026-0918, CVE-2026-0919 & CVE-2026-1315)

Description of Vulnerabilities and Impacts:

CVE-2025-0918: Null Pointer Dereference in Tapo SmartCam HTTP Service

The camera’s HTTP service does not safely handle POST requests containing an excessively large Content-Length header. The resulting failed memory allocation triggers a NULL pointer dereference, causing the main service process to crash.

An unauthenticated attacker can repeatedly crash the service, causing temporary denial of service. The device restarts automatically, and repeated requests can keep it unavailable.

CVE-2025-0919: Unauthenticated Denial of Service via Oversized URL in HTTP Parser

The HTTP parser improperly handles requests containing an excessively long URL path. An invalid‑URL error path continues into cleanup code that assumes allocated buffers exist, leading to a crash and service restart.

An unauthenticated attacker can force repeated service crashes or device reboots, causing denial of service.

CVE-2025-1315: Unauthenticated Denial of Service via Firmware Update Endpoint

By sending crafted files to the firmware update endpoint, the device terminates core system services before verifying authentication or firmware integrity.

An unauthenticated attacker can trigger a persistent denial of service, requiring a manual reboot or application‑initiated restart to restore normal device operation.

The above vulnerabilities have the same CVSS score ratings:

CVSS v4.0 Score: 7.1 / High

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected Products/Versions and Fixes:

Recommendations:

We strongly recommend that users with affected devices take the following actions:

1. Download and update to the latest firmware version to fix the vulnerabilities.

US: https://www.tp-link.com/us/support/download/tapo-c220/v1.60/

https://www.tp-link.com/us/support/download/tapo-c520ws/v2/

EN: https://www.tp-link.com/en/support/download/tapo-c220/v1/

https://www.tp-link.com/en/support/download/tapo-c520ws/v2/

Disclaimer:

If you do not take all recommended actions, this vulnerability will remain. TP-Link cannot bear any responsibility for consequences that could have been avoided by following this advisory.