CVE-2026-0918
Published: 27 January 2026
Summary
CVE-2026-0918 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Tp-Link Tapo C220 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
NULL dereference in public HTTP service enables remote unauthenticated exploitation of a network-facing application (T1190) to trigger application crash and sustained DoS (T1499.004).
NVD Description
The Tapo C220 v1 and C520WS v2 cameras’ HTTP service does not safely handle POST requests containing an excessively large Content-Length header. The resulting failed memory allocation triggers a NULL pointer dereference, causing the main service process to crash. An…
more
unauthenticated attacker can repeatedly crash the service, causing temporary denial of service. The device restarts automatically, and repeated requests can keep it unavailable.
Deeper analysisAI
CVE-2026-0918 is a NULL pointer dereference vulnerability (CWE-476) in the HTTP service of TP-Link Tapo C220 v1 and C520WS v2 cameras. The service does not safely handle POST requests with an excessively large Content-Length header, resulting in a failed memory allocation that triggers the dereference and crashes the main service process. Published on 2026-01-27 with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), it poses a high availability risk without impacting confidentiality or integrity.
An unauthenticated attacker can exploit the vulnerability remotely over the network by sending a POST request with an oversized Content-Length header, causing an immediate crash of the main service process and temporary denial of service. The affected camera automatically restarts following the crash, but an attacker can repeat the requests to sustain unavailability indefinitely.
TP-Link provides firmware download pages for the Tapo C220 v1, C520WS v2, and related models like C100 v5 and C220 v1.60, indicating patches are available for mitigation. Further technical details on the vulnerability and discovery are documented in the security research post at crac-learning.com/post/smart-home-security-research-cve-2026-0918-assigned.
Details
- CWE(s)