TP-Link Tapo Camera EUVD-2026-90981

Exploitation requires the attacker to be on the same local network segment as the camera (CVSS AV:A, adjacent) and targets the HTTPS onboarding scan function specifically AFTER the camera has completed initial setup. No authentication is required (PR:N) and no user interaction is needed (UI:N) against affected Tapo C120 v1 and C200 V5 units. The primary limiting factor is the adjacency requirement - the attacker must already have local network access (wired LAN or associated Wi-Fi), so the flaw is not remotely exploitable from the internet; impact is further limited to disclosure of wireless-environment metadata, with no code execution, credential theft, or video access.

This is a genuine but low-to-moderate priority issue, not a critical one. The CVSS 4.0 base score of 5.3 (vector AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N) accurately reflects the profile: adjacent-network attack vector (not internet-routable), low complexity, no privileges, no user interaction, but only LOW confidentiality impact and zero integrity or availability impact. The vulnerability (CWE-306, missing authentication) exposes wireless-environment metadata rather than credentials, firmware, or video streams, so the technical impact is information disclosure of relatively low sensitivity. No EPSS score, no CISA KEV listing, and no public POC were provided in the input - exploitation status is therefore 'no public exploit identified at time of analysis.' There is no conflict between the CVSS vector and the description: both consistently indicate an unauthenticated attacker already present on the same local wireless/LAN segment. The low EPSS/KEV absence combined with the adjacent-only vector and low-value payoff suggests this is unlikely to see widespread automated exploitation; realistic abuse requires an attacker already positioned on the victim's network, which bounds the real-world risk well below the raw severity of many network-facing authentication bypasses.

An attacker who has gained a foothold on the same local network as the camera (e.g., a guest Wi-Fi user or a compromised IoT device) sends the unauthenticated HTTPS onboarding scan request to a Tapo C120 v1 or C200 V5 after its initial setup. The camera responds with nearby access-point metadata - SSIDs, BSSIDs, authentication/encryption modes, and signal strength - letting the attacker map the surrounding wireless topology. No public exploit code is identified at time of analysis; exploitation requires only low complexity and no authentication once network-adjacent.