CVE-2026-75618 in Tapo C100
Summary
by MITRE • 08/19/2026
Tapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reboot. Successful exploitation can disrupt live video streaming functionality and cause a temporary denial-of-service condition.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The Tapo C100 and C101 V5 smart home cameras are susceptible to a critical null pointer dereference vulnerability within their Real-Time Streaming Protocol service implementation. This flaw resides in the handling of incoming RTSP requests, where the software fails to adequately validate input parameters before attempting to access memory locations associated with those inputs. Specifically, when an attacker transmits specially crafted network packets containing malformed or missing fields expected by the application logic, the underlying code attempts to dereference a pointer that has not been properly initialized or allocated. This type of error is classified under CWE-476, which denotes NULL Pointer Dereference, and represents a fundamental failure in input validation and memory safety checks within the embedded firmware architecture.
From an operational perspective, this vulnerability allows for remote code execution at the level of service stability rather than arbitrary command injection. Because the RTSP daemon runs with elevated privileges to manage video streams, triggering this null pointer dereference causes immediate termination of the process. On many IoT devices running lightweight operating systems like OpenWrt or embedded Linux variants common in consumer cameras, such a crash often triggers an automatic watchdog restart mechanism designed to restore service availability. Consequently, successful exploitation results in a complete device reboot cycle rather than persistent compromise, although the transient nature of this state is sufficient to achieve significant disruption.
The primary impact of exploiting this vulnerability is a denial-of-service condition affecting live video streaming capabilities. An attacker positioned on the same local network segment can repeatedly send these crafted requests to force continuous reboots or prolonged downtime periods where the camera becomes unresponsive. This disrupts security monitoring functions, potentially creating blind spots in surveillance coverage during critical windows of activity. Furthermore, frequent rebooting may lead to wear on flash storage components over time and degrade user trust in the reliability of the smart home ecosystem. The attack vector is classified as local network-based under MITRE ATT&CK framework techniques related to resource hijacking or service disruption via application layer attacks, specifically leveraging protocol-specific flaws in streaming services.
Mitigation strategies for this vulnerability primarily involve applying vendor-provided firmware updates that patch the input validation logic within the RTSP handler. Until such patches are available and deployed, network segmentation is recommended as a defensive measure. Placing IoT devices on isolated VLANs separate from critical infrastructure limits an attacker's ability to reach the vulnerable service endpoint. Additionally, disabling remote access features if not strictly necessary reduces the attack surface by ensuring that only trusted local networks can interact with the RTSP interface. Security administrators should also monitor for unusual patterns of network traffic targeting port 554 or other common RTSP ports from unauthorized sources within their internal subnets to detect potential exploitation attempts in real-time.