Which versions of TP-Link Tapo C200 are affected by CVE-2026-1871?

TP-Link Tapo C200 v5 IP cameras are vulnerable to network-based denial of service attacks that disable surveillance systems and force device reboots, creating operational gaps in physical security…. A patch is available.

How to fix or mitigate CVE-2026-1871?

Within 24 hours: Identify all Tapo C200 v5 cameras and implement firewall rules restricting RTSP access to trusted networks only. Within 7 days: Obtain the latest patched firmware from TP-Link and schedule maintenance windows for camera updates. Within 30 days: Complete firmware deployment to all affected Tapo C200 v5 cameras and verify all systems are running patched versions.

TP-Link Tapo C200 CVE-2026-1871

Q: What is the CVSS score of CVE-2026-1871?

CVE-2026-1871 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33978 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-02 TPLink

GHSA-92jw-rf4g-rwr2

Buffer Overflow TP-Link Denial Of Service Stack Overflow

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 17:30 vuln.today

CVSS changed

Jun 02, 2026 - 17:22 NVD

7.1 (HIGH)

DescriptionCVE.org

TP-Link Tapo C200 v5 contains a stack-based buffer overflow flaw in RTSP authentication handling due to improper validation of Authorization header field lengths, which can be triggered by a crafted authentication request.

Successful exploitation causes the affected RTSP core service process to crash and triggers an automatic system reboot, resulting in a denial of service (DoS) condition. This prevents legitimate users from accessing the camera’s live video stream or management interface until the service restarts.

AnalysisAI

Denial of service in TP-Link Tapo C200 v5 IP cameras allows adjacent network attackers to crash the RTSP service and force a device reboot by sending a crafted Authorization header in an RTSP authentication request. The flaw is a stack-based buffer overflow (CWE-121) in the RTSP authentication handler; no public exploit identified at time of analysis, but vendor-acknowledged and patched firmware is available from TP-Link.

Technical ContextAI

The Tapo C200 v5 is a consumer/SMB Wi-Fi pan-tilt IP camera that exposes a Real Time Streaming Protocol (RTSP) service for live video access. RTSP authentication typically uses HTTP-style Digest or Basic challenges carried in an Authorization header. The CWE-121 stack-based buffer overflow indicates that the camera's RTSP core service copies the Authorization header value into a fixed-size stack buffer without first validating its length, so an oversized header overruns the buffer, corrupts the call stack, and crashes the service. The CPE confirms the issue is scoped to cpe:2.3:a:tp-link_systems_inc.:tapo_c200_v5, i.e. the v5 hardware revision of the Tapo C200 line.

RemediationAI

Patch available per vendor advisory: download and install the latest Tapo C200 v5 firmware from the TP-Link release-notes page (https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes, regional mirrors at /en/ and /kr/) and reference the vendor FAQ at https://www.tp-link.com/us/support/faq/5113/ for confirmation of the fixed build. As the exact patched version string is not included in the input, verify the installed firmware against the release notes after upgrading. Until firmware can be applied, segment the camera onto an isolated IoT VLAN or dedicated SSID so only trusted hosts share its broadcast domain (limits the AV:A attack surface), disable the RTSP service via the Tapo app if live RTSP streaming is not required (loses third-party NVR/VLC integration), and block inbound RTSP (TCP/554) from untrusted clients at the access point or router firewall.