PT-2026-4988 · Tapo · Tapo C520Ws+1

Giuseppe Signorelli · Publicado 2026-01-27 · Atualizado 2026-03-12 · CVE-2026-0919

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Tapo C220 version 1 Tapo C520WS version 2

Description The HTTP parser in the cameras does not correctly process requests with very long URL paths. This leads to a crash and service restart due to improper handling of allocated buffers in cleanup code. An attacker who does not need to be authenticated can repeatedly crash the service or reboot the device, resulting in a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2026-0919

Produtos afetados

Tapo C220

Tapo C520Ws

Referências · 13

• https://tp-link.com/en/support/download/tapo-c220/v1 · Correção
• https://twitter.com/dailycve/status/2031944932923973993 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-0919 · Aviso do Fabricante
• https://tp-link.com/us/support/faq/4923 · Aviso do Fabricante
• https://tp-link.com/en/support/download/tapo-c210/v3 · Correção
• https://tp-link.com/us/support/download/tapo-c520ws/v2 · Correção
• https://twitter.com/VulmonFeeds/status/2016279296147341726 · Publicação no Twitter
• https://tp-link.com/us/support/download/tapo-c220/v1.60 · Correção
• https://t.me/cveNotify/155187 · Publicação no Telegram
• https://tp-link.com/en/support/download/tapo-c520ws/v2 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-0919 · Nota de Segurança
• https://tp-link.com/us/support/download/tapo-c210/v3 · Correção
• https://twitter.com/CVEnew/status/2016217613945491575 · Publicação no Twitter