CVE-2026-75618

MediumCVSS 6.5/10Last modified Oct 26, 2026

Description

Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reboot. Successful exploitation can disrupt live video streaming functionality and cause a temporary denial-of-service condition.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
TP-Link Systems Inc.	Tapo C100 v5	< 1.5.4 Build 260528 Rel.11462n
TP-Link Systems Inc.	Tapo C101 v5	< 1.5.4 Build 260528 Rel.11462n

References

https://www.tp-link.com/en/support/download/tapo-c100/#Firmware-Release-NotesRelease Notes
https://www.tp-link.com/us/support/download/tapo-c100/#Firmware-Release-NotesRelease Notes
https://www.tp-link.com/us/support/download/tapo-c101/#Firmware-Release-NotesRelease Notes
https://www.tp-link.com/us/support/faq/5251/Vendor Advisory

Timeline

Published: Aug 19, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-756195.7Tapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network ca CVE-2026-75624.3The WP-Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.3. This is due t CVE-2026-756216.2IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to excessive permissions CVE-2026-756248.8IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.27 could allow a remote authenticated attacker to bypass CVE-2026-756259.0Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressab CVE-2026-756269.3SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers ca CVE-2026-756279.8Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentic CVE-2026-756285.7Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backsla CVE-2026-756295.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu CVE-2026-75634.3The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access in CVE-2026-756317.8Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the cu CVE-2026-756327.5CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.