EUVD-2026-39026
GHSA-25hh-rw6j-95ch
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-network attacker (AV:A) sends fragments with no auth or interaction (AC:L/PR:N/UI:N); impact is availability-only (A:H) with no confidentiality or integrity loss and no scope change.
Primary rating from Vendor (TPLink).
CVSS VectorVendor: TPLink
Lifecycle Timeline
1DescriptionCVE.org
A denial-of-service (DoS) vulnerability has been identified in Tapo C200 v3 in the network packet handling logic due to improper handling of IPv4 fragmented packets. An unauthenticated adjacent attacker can send crafted packets to cause excessive resource consumption, leading to instability of the device.Successful exploitation can remotely trigger a temporary denial-of-service condition, causing the camera to become unresponsive and resulting in intermittent loss of video monitoring and recording.
AnalysisAI
Remote denial-of-service in the TP-Link Tapo C200 v3 home security camera allows an unauthenticated attacker on the adjacent network to crash or destabilize the device by sending malformed IPv4 fragmented packets. Exploitation drives excessive resource consumption (CWE-770) and renders the camera unresponsive, causing intermittent loss of live video monitoring and recording. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV; TP-Link, who reported it, has released a firmware fix.
Technical ContextAI
The flaw lives in the camera's network packet handling logic, specifically its reassembly/handling of fragmented IPv4 datagrams. IPv4 fragmentation splits oversized packets into smaller fragments that the receiving stack must buffer and reassemble; without strict limits on the number, size, or rate of in-flight fragments, an attacker can force the device to allocate memory or CPU faster than it can reclaim them. This maps directly to CWE-770 (Allocation of Resources Without Limits or Throttling) - the root cause is missing bounds on resources consumed during fragment processing on a resource-constrained embedded IoT device. The affected component is identified by CPE cpe:2.3:a:tp-link_systems_inc.:tapo_c200_v3, TP-Link's Tapo C200 hardware version 3 Wi-Fi pan/tilt camera.
RemediationAI
Patch available per vendor advisory: update the Tapo C200 v3 to the latest firmware listed in TP-Link's release notes (https://www.tp-link.com/us/support/download/tapo-c200/v3/#Firmware-Release-Notes or the EN mirror), as an exact fixed build number was not provided in the input - confirm the current version against those release notes before and after updating. TP-Link's supporting advisory is at https://www.tp-link.com/us/support/faq/5143/. Because the attack is adjacent-network only, effective compensating controls until patched are: isolate the camera on a dedicated IoT VLAN or guest SSID to remove untrusted devices from its broadcast/local segment (trade-off: requires router/AP support and may complicate app discovery and local streaming), and restrict Wi-Fi access with strong WPA2/WPA3 credentials to limit who can reach the device at layer 2. Network-layer fragment filtering is impractical on consumer gear, so segmentation is the primary stopgap; note these controls reduce exposure but do not eliminate the flaw for an attacker already on the same segment.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today