The vulnerability in Tapo C120 v1 and C200 v5 involves a NULL pointer dereference in the HTTPS onboarding connect request parser. The affected interface is reachable without authentication post-initial setup and does not verify that a password field is present for specific authentication and encryption parameter combinations. This flaw allows a malformed request from the local network to crash the HTTPS service, resulting in temporary unavailability of HTTPS management functions. Repeated exploitation can sustain the denial-of-service condition, potentially necessitating device reboot for recovery.

Successful exploitation causes temporary denial of service of HTTPS management functions on the affected devices. Repeated malformed requests can prolong the outage, and in some cases, recovery requires rebooting the device. There is no indication of privilege escalation or data compromise from the provided information.

No patch or official fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local network access to the affected devices' HTTPS onboarding interface to trusted users only to reduce risk of exploitation.