Tapo C200 CVE-2026-15315

Exploitation requires the attacker to be on the same local network segment (LAN or Wi-Fi) as the target device - this adjacency requirement is the primary limiting factor and renders internet-based exploitation impossible in default deployments. The vulnerability manifests during the challenge-response phase of the authentication process and requires no prior authentication to the device (PR:N per CVSS 4.0) and no user interaction. The camera must be running hardware version 5 with firmware below V5_1.4.6 Build 260709 Rel.27675n. No non-default feature or configuration setting needs to be enabled - the vulnerable authentication module is active in the device's default operational state. Exploitation is not possible from the internet unless the camera's management interface is explicitly port-forwarded or exposed via a reverse proxy, which is not a default or recommended configuration.

The CVSS 4.0 base score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) reflects a genuinely high-impact flaw with one critical constraint: the adjacent-network attack vector (AV:A) means exploitation requires presence on the same local network segment as the camera. This substantially limits internet-facing exposure relative to AV:N vulnerabilities and is the primary risk-reduction factor. Low attack complexity (AC:L) with no prerequisite privileges (PR:N) or user interaction (UI:N) means that once adjacency is achieved, exploitation is straightforward. No EPSS score was provided in source data, the vulnerability does not appear in CISA's KEV catalog, and no proof-of-concept exploit has been identified at time of analysis - these absences reduce urgency relative to a KEV-listed flaw. However, consumer IoT cameras are routinely deployed on flat home or SMB networks where compromise of a single co-located device immediately grants adjacency, a deployment reality that elevates practical risk above what the AV:A vector alone implies. The CVSS 4.0 vector is consistent with the description and no conflicting signals were identified in the source data.

An attacker connected to the same Wi-Fi or LAN segment as a vulnerable Tapo C200 v5 camera sends a crafted authentication request with manipulated challenge parameters to the camera's management interface. The authentication verification module accepts the malformed response as valid and issues an administrative session token to the attacker without requiring knowledge of the camera's credentials. The attacker then uses this token to access the live camera feed, alter device configuration, or issue disruptive management commands that cause a denial-of-service condition.