Tapo C100/C101 EUVD-2026-62632

Exploitation requires network adjacency: the attacker must be on the same local network segment or Wi-Fi network as the camera (CVSS AV:A). No authentication is required to reach or exploit the RTSP service (CVSS PR:N), and no victim user interaction is needed (CVSS UI:N). The vulnerability is specific to Tapo C100 V5 and C101 V5 hardware revisions only - other hardware revisions are not confirmed affected. The attack surface is bounded by the RTSP service port; devices behind NAT without port forwarding of RTSP are not reachable from the internet. What limits exploitation: the adjacent-network constraint means only LAN-local or Wi-Fi-local attackers can reach the service; the impact is strictly availability (no credential theft, no persistent compromise, no lateral movement vector from this flaw alone); and cameras self-recover after the reboot cycle completes.

The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) characterizes this as a low-complexity, unauthenticated, availability-only impact reachable from the adjacent network - a profile consistent with a moderate but contained risk. The adjacent-network constraint (AV:A) is the most significant limiting factor: exploitation requires the attacker to be co-located on the same LAN or Wi-Fi segment as the camera, excluding internet-based threat actors in typical NAT-behind deployments. The impact ceiling is a temporary service disruption - no confidentiality or integrity risk exists (VC:N/VI:N), and cameras self-recover after reboot. No CISA KEV listing is present and no public POC has been identified, meaning real-world exploitation has not been confirmed. EPSS data was not provided, so statistical exploitation likelihood cannot be assessed. The aggregate signal is: real vulnerability, real DoS impact for any network monitoring workflow dependent on these cameras, but attack surface is constrained to adjacent-network actors with no elevated privileges. Environments with guest Wi-Fi, shared IoT segments, or previously compromised LAN hosts face a materially higher practical risk than those with strict network segmentation. Patching is straightforward given vendor firmware availability.

An attacker positioned on the same Wi-Fi or wired LAN segment as the target camera - for example, a guest network user or a compromised IoT device on the same subnet - sends a specially crafted RTSP request to the camera's streaming port. The vulnerable RTSP parser dereferences a null pointer while processing the malformed request, immediately crashing the RTSP service and triggering a full device reboot. The camera goes offline for the duration of the reboot cycle, blinding any live video monitoring or NVR recording dependent on that feed. No public POC has been identified; the attack is straightforward given the low complexity rating in the CVSS vector.