This vulnerability arises from insufficient validation of encrypted credential data inputs in the Tapo C200 v5 configuration service. Attackers can send oversized encrypted ciphertext values that trigger exception handling failures, resulting in device crashes or restarts. This disrupts HTTPS management and monitoring functions temporarily, causing a denial-of-service condition until the service recovers.

Exploitation causes temporary denial-of-service by crashing or restarting the affected device, disrupting HTTPS management and monitoring functionality until recovery. There is no indication of privilege escalation, data disclosure, or persistent compromise.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitor for unusual device restarts and avoid exposure of the management interface to untrusted networks.