Missing authentication on the HTTPS connectAP interface in TP-Link Tapo C200 V3 firmware (versions 1.3.3 through 1.4.1) allows adjacent network attackers to remotely reconfigure device Wi-Fi settings, causing permanent denial-of-service until manual intervention. The vulnerability exploits CWE-306 (Missing Authentication for Critical Function) with CVSS 8.7 severity, requiring only adjacent network access with low attack complexity and no user interaction. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the technical barrier is minimal for LAN-positioned adversaries.
Stack-based buffer overflow in the ONVIF SOAP XML parser of TP-Link Tapo C200 v3 (firmware ≤1.4.1) and C520WS v2.6 cameras enables unauthenticated remote code execution from adjacent networks. Attackers can send crafted SOAP requests with oversized namespace prefixes to trigger memory corruption and achieve full device compromise with elevated privileges. EPSS probability and KEV status indicate no public exploit identified at time of analysis, though the vulnerability affects widely deployed consumer IoT cameras with network exposure.
Local privilege escalation in Versa SASE Client for Windows (versions 7.8.7 through 7.9.4) allows authenticated local users to achieve NT AUTHORITY\SYSTEM execution by abusing the audit log export feature. The client passes user-controlled file paths to a privileged background service that performs file system operations without impersonating the caller, and a TOCTOU race window combined with symbolic link and mount point manipulation coerces the service into deleting arbitrary directories as SYSTEM. Deletion of protected Windows Installer directories such as C:\Config.msi, followed by MSI rollback techniques, yields full SYSTEM code execution. No public exploit code or CISA KEV listing has been identified at time of analysis.