From having online meetings to getting real CVEs, the CRAC Learning team did it all! We discovered a Denial-of-Service vulnerability in the HTTP service of the TP-Link Tapo C100 v5 IP camera. Sending a POST request with an excessively large Content-Length header causes the main HTTP process to crash, freezing video and audio streams and forcing a restart. TP-Link acknowledged and published a fix; the issue was assigned CVE-2026–0918 and a High score (CVSS v4.0 7.1). Tapo cameras are widely...

Before reading this part, go over our previous blog - https://www.crac-learning.com/post/smart-security-research-diaries-defending-the-internet-of-things Then I started the Phase-1 of Smart Home Security Research Program by CRAC Learning with great enthusiasm & aspirations to find real vulnerabilities, not just solving TryHackMe labs. When I found that I'll be attacking the TP-Link Tapo C100 IP Camera, the first thing I did was Threat Modelling. I dived deep into gathering past...

18th of January, 2026 - The day started with some network troubleshooting and system administration as we forgot to bring our wi-fi router that was earlier acting as a gateway. But yeah, after scratching our heads we were finally able to use one of our laptops as the gateway which really helped us capture all the data frames via Wireshark. Today, our main goal was to get Remote Code Execution on our target. Last time we found a Buffer-Overlfow based Denial-of-Service vulnerability which was...