CVE-2026-9032: Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerability in TP-Link Tapo C120 & C200
Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate that a password field is present for certain authentication and encryption parameter combinations, allowing a malformed request from the same local network to crash the HTTPS service
Successful exploitation may temporarily make HTTPS management functions unavailable. Repeated malformed requests may sustain the denial-of-service condition, and recovery may in some cases require a device reboot.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Operational
Reboot the affected Tapo C120 v1 or C200 v5 device to recover when repeated malformed onboarding connect requests sustain the denial-of-service condition or make HTTPS management functions unavailable.
Event History
Frequently Asked Questions
Which devices and deployments are exposed?
The affected products are TP-Link Tapo C120 hardware version 1 and Tapo C200 hardware version 5. The vulnerable HTTPS onboarding interface remains reachable without authentication after initial setup.
What does an attacker need to exploit this issue?
An attacker must be on the same local network and send a malformed HTTPS onboarding connect request using certain authentication and encryption parameter combinations that omit the password field. No authentication is required.
What is the operational impact of exploitation?
A successful request can crash the device's HTTPS service, temporarily preventing HTTPS management functions from working. Repeated malformed requests can maintain the denial-of-service condition, and recovery may sometimes require rebooting the device.