Which versions of Tapo C220 Firmware are affected by CVE-2026-0919?

Tapo C220 v1 and C520WS v2 cameras are vulnerable to denial-of-service attacks that can crash and restart the devices through malformed URL requests.

How to fix or mitigate CVE-2026-0919?

Within 24 hours: Inventory all Tapo C220 v1 and C520WS v2 cameras in your environment and isolate them to segmented networks with restricted external access. Within 7 days: Implement network-based protections (WAF rules blocking excessively long URL paths) and disable remote access if not operationally critical. Within 30 days: Evaluate replacement with patched firmware versions or alternative vendors; monitor TP-Link security advisories for patch availability and plan immediate deployment upon release.

Tapo C220 Firmware CVE-2026-0919

Q: What is the CVSS score of CVE-2026-0919?

CVE-2026-0919 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

Improper Input Validation (CWE-20)

2026-01-27 f23511db-6c3e-4e32-a477-6aa17d310630

Denial Of Service Tapo C220 Firmware Tapo C520ws Firmware

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 29, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

Apr 29, 2026 - 17:22 NVD

7.5 (HIGH) 7.1 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Jan 27, 2026 - 18:15 nvd

HIGH 7.5

DescriptionCVE.org

The HTTP parser of Tapo C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively long URL path. An invalid‑URL error path continues into cleanup code that assumes allocated buffers exist, leading to a crash and service restart. An unauthenticated attacker can force repeated service crashes or device reboots, causing denial of service.

AnalysisAI

Tapo C220 and C520WS network cameras contain an HTTP parser defect that crashes the device when processing requests with excessively long URL paths, allowing unauthenticated remote attackers to trigger repeated denial of service through device reboots. The vulnerability stems from improper error handling that attempts to access unallocated buffers during cleanup operations. No patch is currently available for affected firmware versions.

Technical ContextAI

Classified as CWE-20 (Improper Input Validation). Affects Tapo C220 Firmware. The HTTP parser of Tapo C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively long URL path. An invalid‑URL error path continues into cleanup code that assumes allocated buffers exist, leading to a crash and service restart. An unauthenticated attacker can force repeated service crashes or device reboots, causing denial of service.