Cooper Young

**Name of the Vulnerable Software and Affected Versions** Tapo C100/C101 V5 **Description** The RTSP service contains a null pointer dereference issue, which occurs when a program attempts to read or write to a memory address that is null, leading to a crash. An attacker on the local network can send specially crafted requests to the service, causing it to dereference an invalid pointer. This results in a service crash and device reboot, disrupting live video streaming and creating a temporary denial-of-service condition. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Tapo C100/C101 V5 **Description** A heap-based buffer overflow exists in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, leading to out-of-bounds heap writes. This can crash the RTSP service and trigger a device reboot, causing a temporary denial-of-service condition. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TP-Link Tapo C100/C101 version 5 TP-Link Tapo C520WS version 2.6 **Description** A heap-based buffer overflow occurs in the HTTP POST body parsing logic due to insufficient boundary validation and missing validation of remaining buffer capacity after dynamic allocation when handling externally supplied HTTP input. An attacker on the same network segment can trigger heap memory corruption by sending crafted payloads that cause write operations beyond the allocated buffer boundaries. Successful exploitation can lead to a Denial-of-Service (DoS) condition, causing the device process to crash or become unresponsive, or potentially enable remote code execution (RCE). **Recommendations** Update TP-Link Tapo C100/C101 version 5 to the latest firmware released by TP-Link. Update TP-Link Tapo C520WS version 2.6 to the latest firmware released by TP-Link. Implement robust input validation on network perimeters and segment devices to reduce exposure.