TP-Link Tapo CVE-2026-9032

Exploitation requires network reachability to the Tapo C120 v1 or C200 v5 HTTPS onboarding connect endpoint on the same local network segment (CVSS AV:A, not internet-routable by default). The endpoint becomes reachable without authentication only after the device has completed initial setup. The specific trigger is a malformed onboarding connect request that omits the password field for certain authentication and encryption parameter combinations the parser fails to validate. Limiting factors: the attacker must have adjacent/LAN access (compromised Wi-Fi or a foothold on the local network), impact is confined to crashing the HTTPS management service (no RCE, no data disclosure), and the condition is transient - service typically recovers, though some cases require a device reboot. Sustained denial of service requires repeated malformed requests.

This is a moderate-severity availability-only flaw whose signals are internally consistent rather than conflicting. The vendor-provided CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) indicates an adjacent-network, low-complexity, unauthenticated attack with no confidentiality or integrity impact and only high availability impact - matching the description's claim of an unauthenticated local-network DoS against the HTTPS onboarding parser. The CVSS 4.0 base score of 7.1 is driven almost entirely by the VA:H availability component plus the easy attack conditions; it is NOT a code-execution or data-exposure bug (CWE-476 NULL pointer dereference), so the practical blast radius is limited to crashing the HTTPS management service. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so there is no evidence of active or automatable exploitation. The AV:A rating (adjacent, not network) is the single most important risk limiter: an attacker must already be on the same local network segment as the camera, which substantially narrows the realistic threat to local/LAN-resident adversaries rather than internet-wide scanning. Treat this as a real-but-bounded local DoS issue - patch it on exposure-sensitive deployments, but it does not warrant emergency prioritization in the absence of any exploitation signal.

An attacker already present on the same local network (e.g., via compromised Wi-Fi or another LAN device) sends a malformed HTTPS onboarding connect request that omits the password field for certain authentication/encryption parameter combinations, triggering a NULL pointer dereference that crashes the camera's HTTPS management service. No public exploit was identified at time of analysis. Because the endpoint is reachable without authentication after initial setup, no credentials or user interaction are needed, though adjacent-network access is required.