Tapo C200 CVE-2026-12760

Exploitation requires the attacker to be on the adjacent network (AV:A) - the same local/Wi-Fi broadcast segment as the camera - and to send crafted IPv4 fragmented packets to the device; no authentication, credentials, or user interaction is needed (PR:N/UI:N), and no special camera feature or non-default configuration is called out as a prerequisite. The principal limiting factor is the adjacency requirement: this cannot be exploited directly from the internet, so the attacker must first obtain local network access (compromised LAN host, shared/guest Wi-Fi, or rogue device). The impact is also self-limiting - availability only (VA:H, confidentiality/integrity unaffected) and described by the vendor as a temporary, recoverable condition, so the camera typically resumes once the malicious traffic stops.

The supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H, base 7.1) is internally consistent with the description: adjacent attack surface, low complexity, no privileges or user interaction, and an availability-only impact (VA:H) with no confidentiality or integrity loss. There is no EPSS score, no SSVC decision, and no POC provided, and the CVE is not in CISA KEV, so there is no evidence of active or automatable exploitation. The most important limiting factor is AV:A - the attacker must be on the same local/Wi-Fi segment as the camera, not anywhere on the internet, which sharply narrows real-world reach to attackers who already have local network access (e.g., a compromised LAN, shared Wi-Fi). Net assessment: a genuine but bounded risk - meaningful for availability-sensitive surveillance use, yet not an internet-wide mass-exploitation threat, and the impact is a temporary, recoverable outage rather than data compromise or code execution.

An attacker who has gained access to the same Wi-Fi network as the camera - for example via a weak Wi-Fi password or another compromised device on the LAN - sends a stream of crafted, malformed IPv4 fragmented packets to the Tapo C200 v3. The camera's packet handling logic exhausts memory or CPU reassembling the fragments and becomes unresponsive, dropping live video and recording for the duration of the attack. No exploit code is publicly known at time of analysis, but the low attack complexity (AC:L) and absence of any authentication or user interaction make the technique straightforward for a locally positioned adversary.