EUVD-2026-62193
GHSA-xw5g-644p-8357
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-network access required; no prerequisites or interaction needed; full CIA impact on the camera itself; scope unchanged as no lateral system compromise is described.
Primary rating from Vendor (f23511db-6c3e-4e32-a477-6aa17d310630).
CVSS VectorVendor: f23511db-6c3e-4e32-a477-6aa17d310630
Lifecycle Timeline
2DescriptionCVE.org
Tapo C200 v5 contains an improper authentication vulnerability within the login authentication verification module. An attacker on the local network can exploit weaknesses in challenge parameter validation to bypass normal authentication controls and obtain administrative session tokens.
Successful exploitation may allow an attacker to subsequently execute privileged management actions, enable unauthorized administrative access and temporary disruption of device services, resulting in a denial-of-service (DoS) condition.
AnalysisAI
Authentication bypass in TP-Link Tapo C200 v5 IP cameras running firmware below V5_1.4.6 Build 260709 Rel.27675n allows unauthenticated adjacent-network attackers to manipulate challenge parameters during the login handshake, circumventing the authentication verification module and obtaining valid administrative session tokens. With those tokens, an attacker can execute privileged management operations - including reconfiguring the camera, accessing live or recorded footage, and deliberately disrupting device services to cause a denial-of-service condition. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be on the same local network segment (LAN or Wi-Fi) as the target device - this adjacency requirement is the primary limiting factor and renders internet-based exploitation impossible in default deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) reflects a genuinely high-impact flaw with one critical constraint: the adjacent-network attack vector (AV:A) means exploitation requires presence on the same local network segment as the camera. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade Tapo C200 v5 firmware to V5_1.4.6 Build 260709 Rel.27675n or later, available directly from the TP-Link support page at https://www.tp-link.com/us/support/download/tapo-c200/v5/; updates can also be applied via the Tapo mobile application. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a network inventory to identify all TP-Link Tapo C200 v5 cameras running firmware below V5_1.4.6 Build 260709 Rel.27675n. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Tapo C200 Firmware
View allMissing authentication on the HTTPS connectAP interface in TP-Link Tapo C200 V3 firmware (versions 1.3.3 through 1.4.1)
Stack-based buffer overflow in the ONVIF SOAP XML parser of TP-Link Tapo C200 v3 (firmware ≤1.4.1) and C520WS v2.6 camer
The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused acros
Denial-of-service in TP-Link Tapo C200 v5 IP cameras allows adjacent-network unauthenticated attackers to crash the devi
TP-Link cloud cameras through 2020-02-09 allow remote attackers to bypass authentication and obtain sensitive informatio
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today