{"id":"CVE-2026-9032","title":"Tapo C120 v1 and C200 v5\ncontain a NULL pointer dereference in the HTTPS onboarding connect request parser.  The interface is reachable without\nauthentication after initial setup and does not validate that a password field\nis present for…","summary":"Tapo C120 v1 and C200 v5\ncontain a NULL pointer dereference in the HTTPS onboarding connect request parser.  The interface is reachable without\nauthentication after initial setup and does not validate that a password field\nis present for…","severity":"high","cvss":7.1,"cvssVector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":["CWE-476"],"vendor":"TP-Link Systems Inc.","product":"Tapo C200 V5","affected":["tapo_c200_v5 < V5_1.4.6 Build 260709 Rel.27675n","tapo_c120_v1 < V1_1.9.4 Build 260813 Rel.79754n"],"published":"2026-10-01","updated":"2026-10-06","sourceUpdated":"2026-10-06T19:18:18.800","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-9032","references":[{"url":"https://www.tp-link.com/en/support/download/tapo-c120/v1.26/#Firmware-Release-Notes","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/download/tapo-c120/v1.26/#Firmware-Release-Notes","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes","label":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/faq/5321/","label":"f23511db-6c3e-4e32-a477-6aa17d310630"}],"tags":["nvd","cve.org"],"epss":0.00157,"epssPercentile":0.04766,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-06T18:01:56.089842Z"},"cvssSource":"cna","ingestedAt":"2026-10-01T18:55:42.378Z","slug":"CVE-2026-9032","body":"## Overview\n\nTapo C120 v1 and C200 v5\ncontain a NULL pointer dereference in the HTTPS onboarding connect request parser.  The interface is reachable without\nauthentication after initial setup and does not validate that a password field\nis present for certain authentication and encryption parameter combinations,\nallowing a malformed request from the same local network to crash the HTTPS service\n\n\n\n\n\n\n\n\n\n\n Successful exploitation may\ntemporarily make HTTPS management functions unavailable. Repeated malformed\nrequests may sustain the denial-of-service condition, and recovery may in some\ncases require a device reboot.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}