CVE-2026-75618: RTSP Null Pointer Dereference Denial-of-Service Vulnerability on TP-Link Tapo C100 and C101
Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reboot. Successful exploitation can disrupt live video streaming functionality and cause a temporary denial-of-service condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TP-Link Tapo C100/C101 RTSP serviceto a version that resolves this vulnerability.Fixed in V5
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be on the same local network as the affected camera and able to send specially crafted requests to its RTSP service.
What is the practical impact of a successful attack?
Exploitation crashes the RTSP service and reboots the device, temporarily disrupting live video streaming and causing a denial-of-service condition.
Which devices are identified as affected?
The affected devices identified are TP-Link Tapo C100 V5 and Tapo C101 V5.