CVE-2026-0919
📋 TL;DR
An unauthenticated attacker can send HTTP requests with excessively long URL paths to Tapo C220 v1 and C520WS v2 cameras, causing the HTTP parser to crash and restart the service. This leads to denial of service through repeated device reboots. Only users of these specific camera models are affected.
💻 Affected Systems
- Tapo C220
- Tapo C520WS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Persistent denial of service making cameras unavailable for surveillance, potentially during security incidents.
Likely Case
Intermittent camera outages causing gaps in video recording and monitoring.
If Mitigated
Minimal impact if cameras are behind firewalls or network segmentation.
🎯 Exploit Status
Simple HTTP request with long URL path triggers the vulnerability. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor links for latest firmware
Vendor Advisory: https://www.tp-link.com/us/support/faq/4923/
Restart Required: Yes
Instructions:
1. Visit TP-Link support page for your camera model. 2. Download latest firmware. 3. Log into camera web interface. 4. Navigate to Settings > System > Firmware Upgrade. 5. Upload and install new firmware. 6. Camera will reboot automatically.
🔧 Temporary Workarounds
Network Segmentation
allPlace cameras on isolated VLAN or network segment to limit attack surface
Firewall Rules
allBlock external HTTP access to cameras at network perimeter
🧯 If You Can't Patch
- Isolate cameras from untrusted networks
- Implement rate limiting on HTTP requests to cameras
🔍 How to Verify
Check if Vulnerable:
Send HTTP request with URL path exceeding normal length (e.g., 8192+ characters) to camera HTTP portCheck Version:
Check firmware version in camera web interface under Settings > System > FirmwareVerify Fix Applied:
After patching, same long URL request should not cause service crash📡 Detection & Monitoring
Log Indicators:
- Repeated service restarts
- HTTP parser errors
- Unusually long URL requests in access logs
Network Indicators:
- Multiple HTTP requests with very long URLs to camera IPs
- Increased reboot traffic from cameras
SIEM Query:
source="camera_logs" AND ("restart" OR "crash" OR "parser error") AND url_length>8000