Tapo C100 v5 vulnerabilities

2 known vulnerabilities in Tapo C100 v5 from TP-Link. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Tapo C220 v1: NULL Pointer Dereference

  CVE-2026-0918Jan 27, 2026TP-Link

  The Tapo C100 v5, C220 v1 and C520WS v2 cameras’ HTTP service does not safely handle POST requests containing an excessively large Content-Length header. The resulting failed memory allocation triggers a NULL pointer dereference, causing the main service proce

• 8.1 High severity

  Tapo C200: Missing Authentication for Critical Functionality

  CVE-2025-14300Dec 20, 2025TP-Link

  The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in lo