TP-Link Tapo EUVD-2026-90982

Exploitation requires the attacker to be on an adjacent network (same local/wireless segment as the camera - AV:A), and the camera must have completed initial setup, after which the HTTPS onboarding 'do' method connect actions no longer enforce authentication (CWE-306). Under those conditions the attacker submits unauthorized wireless configuration parameters with no credentials and no user interaction. Limiting factors: the flaw is NOT exploitable from the internet or an arbitrary remote location (adjacent access only), it affects only Tapo C120 v1 and C200 v5, and the impact is confined to denial-of-service (forcing a network switch) with no confidentiality or integrity compromise; a vendor firmware update is available to remove the exposure.

This is a moderate, availability-only issue rather than a top-tier priority. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) scores 7.1 and confirms an unauthenticated, low-complexity attack requiring no user interaction, but the impact is strictly VA:H (availability) with VC:N/VI:N/VA metrics showing no confidentiality or integrity loss - the outcome is denial-of-service (camera knocked off its network), not device takeover or data exposure. The AV:A (adjacent) vector is the single biggest risk limiter: the attacker must already be on the same local/wireless segment, so this is not internet-wide remotely exploitable. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; exploitation probability signals are simply absent rather than conflicting. The CVSS 4.0 vector and the description are consistent (adjacent, unauthenticated, availability-only), with no network-vs-local contradiction to flag. Net: a legitimate flaw worth patching on affected cameras, but the adjacent-access requirement and DoS-only impact place it below critical RCE/data-exposure issues in prioritization.

An attacker who has gained access to the same local/wireless network as a deployed Tapo C120 v1 or C200 v5 camera (e.g., a guest Wi-Fi user or a compromised IoT device) sends an unauthenticated HTTPS onboarding 'do' connect request supplying attacker-chosen wireless parameters. The camera accepts the unauthorized configuration and attempts to join a different network, dropping off its intended management address and becoming unreachable. No public exploit code is identified, and the attack requires only adjacent access with low complexity and no user interaction.