---
id: CVE-2026-9032
title: "Tapo C120 v1 and C200 v5\ncontain a NULL pointer dereference in the HTTPS onboarding connect request parser.\_ The interface is reachable without\nauthentication after initial setup and does not validate that a password field\nis present for…"
summary: "Tapo C120 v1 and C200 v5\ncontain a NULL pointer dereference in the HTTPS onboarding connect request parser.\_ The interface is reachable without\nauthentication after initial setup and does not validate that a password field\nis present for…"
severity: high
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-476
vendor: TP-Link Systems Inc.
product: Tapo C200 V5
affected:
  - tapo_c200_v5 < V5_1.4.6 Build 260709 Rel.27675n
  - tapo_c120_v1 < V1_1.9.4 Build 260813 Rel.79754n
published: '2026-10-01'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T19:18:18.800'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-9032'
references:
  - url: >-
      https://www.tp-link.com/en/support/download/tapo-c120/v1.26/#Firmware-Release-Notes
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: >-
      https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: >-
      https://www.tp-link.com/us/support/download/tapo-c120/v1.26/#Firmware-Release-Notes
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: >-
      https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://www.tp-link.com/us/support/faq/5321/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
tags:
  - nvd
  - cve.org
epss: 0.00157
epssPercentile: 0.04766
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-06T18:01:56.089842Z'
cvssSource: cna
ingestedAt: '2026-10-01T18:55:42.378Z'
---

## Overview

Tapo C120 v1 and C200 v5
contain a NULL pointer dereference in the HTTPS onboarding connect request parser.  The interface is reachable without
authentication after initial setup and does not validate that a password field
is present for certain authentication and encryption parameter combinations,
allowing a malformed request from the same local network to crash the HTTPS service










 Successful exploitation may
temporarily make HTTPS management functions unavailable. Repeated malformed
requests may sustain the denial-of-service condition, and recovery may in some
cases require a device reboot.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.