Tapo C200 EUVD-2026-62194

Exploitation requires the attacker to be on the same adjacent network segment (LAN, VLAN, or wireless network) as the target Tapo C200 v5 device, as confirmed by the AV:A metric in the CVSS 4.0 vector. No authentication is required (PR:N), as the flaw manifests in the configuration service's processing of inbound encrypted payloads before any credential validation occurs. The device must be running firmware prior to V5_1.4.6 Build 260709 Rel.27675n. Exploitation impact is strictly limited to availability - device crash or restart with service self-recovery - with no confidentiality or integrity consequences possible. Internet-based exploitation is not applicable under default camera deployment configurations unless the device's management port has been explicitly forwarded through a NAT gateway or firewall, which is non-default. The automatic service recovery further limits the duration of disruption per exploitation event.

The CVSS 4.0 score of 7.1, derived from a vector of AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N, reflects a moderate-to-high availability-only impact constrained to the adjacent network attack surface. The adjacent network vector (AV:A) is the most significant limiting factor: exploitation demands an attacker already present on the same LAN, VLAN, or wireless segment as the camera, ruling out opportunistic internet-scale attacks. No EPSS score was provided in the available intelligence, and the absence of a CISA KEV listing indicates no confirmed widespread exploitation at this time, meaning even a mid-sized municipal IT team in ustka operating a camera network should treat this as a routine patch cycle rather than an emergency incident. The impact is bounded - device availability is temporarily disrupted with automatic recovery on restart, and there is zero confidentiality or integrity consequence, which substantially reduces the downstream risk compared to a full remote code execution flaw. No POC exploit code was referenced in the provided intelligence sources, and the requirement for adjacent network presence further reduces the attacker population. The primary realistic threat scenario is an insider or a compromised device on the same network segment.

An attacker connected to the same LAN or wireless network segment as a vulnerable Tapo C200 v5 camera sends a crafted configuration request containing an intentionally oversized encrypted ciphertext value to the device's configuration service port. The service's input validation logic fails to reject the oversized payload, the exception propagates through the exception handler without containment, and the device crashes or restarts. During the recovery window, HTTPS management and monitoring are unavailable - a scenario an attacker could exploit to briefly blind a surveillance system during a concurrent physical security breach.