EUVD-2026-62194
GHSA-5fvx-mqqx-vrm4
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent vector (AV:A) reflects LAN-facing config service; PR:N because no auth precedes the vulnerable input path; A:H for device crash; C and I are N as no data exposure or modification is possible.
Primary rating from Vendor (f23511db-6c3e-4e32-a477-6aa17d310630).
CVSS VectorVendor: f23511db-6c3e-4e32-a477-6aa17d310630
Lifecycle Timeline
2DescriptionCVE.org
An improper input validation vulnerability in the configuration service for processing encrypted credential data has been identified in Tapo C200 v5. An attacker can send oversized crypted ciphertext values that may trigger exception handling failures, due to insufficient validation, causing the affected device to crash or restart.
Successful exploitation may temporarily disrupt HTTPS management and monitoring functionality, resulting in a denial-of-service (DoS) condition until the service recovers.
AnalysisAI
Denial-of-service in TP-Link Tapo C200 v5 IP cameras allows adjacent-network unauthenticated attackers to crash the device's configuration service by submitting oversized encrypted ciphertext payloads that trigger unhandled exceptions. Affected firmware versions prior to V5_1.4.6 Build 260709 Rel.27675n are confirmed vulnerable per ENISA EUVD-2026-62194; successful exploitation temporarily disables HTTPS management and monitoring until the service self-recovers, with no confidentiality or integrity impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be on the same adjacent network segment (LAN, VLAN, or wireless network) as the target Tapo C200 v5 device, as confirmed by the AV:A metric in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.1, derived from a vector of AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, reflects a moderate-to-high availability-only impact constrained to the adjacent network attack surface. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade Tapo C200 v5 firmware to V5_1.4.6 Build 260709 Rel.27675n or a later release, available from the TP-Link support portal at https://www.tp-link.com/us/support/download/tapo-c200/v5/; update procedures are documented in the TP-Link FAQ at https://www.tp-link.com/us/support/faq/5248/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all TP-Link Tapo C200 cameras in your environment and identify which are running firmware versions prior to V5_1.4.6 Build 260709 Rel.27675n; immediately isolate confirmed vulnerable units to a dedicated network segment with restricted access from adjacent networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Tapo C200 Firmware
View allAuthentication bypass in TP-Link Tapo C200 v5 IP cameras running firmware below V5_1.4.6 Build 260709 Rel.27675n allows
Missing authentication on the HTTPS connectAP interface in TP-Link Tapo C200 V3 firmware (versions 1.3.3 through 1.4.1)
Stack-based buffer overflow in the ONVIF SOAP XML parser of TP-Link Tapo C200 v3 (firmware ≤1.4.1) and C520WS v2.6 camer
The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused acros
TP-Link cloud cameras through 2020-02-09 allow remote attackers to bypass authentication and obtain sensitive informatio
Same weakness CWE-20 – Improper Input Validation
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today