TP-Link Tapo C120/C200 EUVD-2026-90983

Exploitation requires all of the following concrete conditions, per the description: (1) network position on the SAME local network as the camera (CVSS AV:A - no remote/internet exploitation), (2) capture and replay of the device's login challenge data to forge an administrative session (the authentication bypass, CWE-287), (3) activation of a privileged service that only becomes reachable AFTER a device reboot, and (4) a device reboot to bring that service online, after which crafted input to the MacTool handler achieves command injection. The limiting factors are significant: the attacker must already be on the local network, must successfully replay challenge data, and must obtain/await a reboot before the command-execution stage is exploitable - raising real-world difficulty above the AC:L rating. No credentials or user interaction are required (PR:N/UI:N). Affects only Tapo C120 v1 and Tapo C200 V5.

This is a credible, above-average-priority issue but not a drop-everything emergency. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) rates it 8.7 High: exploitation is unauthenticated (PR:N) with no user interaction, and the triple-high impact (VC:H/VI:H/VA:H) reflects full command execution on the device. The key risk-limiting signal is AV:A (Adjacent/local network), not AV:N - the attacker must already be on the same LAN/Wi-Fi as the camera, which meaningfully narrows the threat to local or already-foothold-established adversaries rather than internet-wide scanning. No EPSS score was provided, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit referenced, so this is no public exploit identified at time of analysis - the flaw was reported by TP-Link itself rather than surfacing from observed attacks. One point of friction to note: the CVSS vector encodes AC:L, yet the description requires a multi-step chain (challenge replay, enabling a privileged service, AND a device reboot before command execution is possible); the reboot and service-activation prerequisites arguably raise real-world attack complexity above a simple single-shot exploit - verify operational difficulty against the vendor advisory. No SSVC decision data was supplied. Net: real priority for environments where untrusted parties share the camera's local network (e.g., guest Wi-Fi, shared offices, compromised IoT segments), lower priority for well-segmented home deployments.

An attacker who has gained access to the same local network as a Tapo C120 v1 or C200 V5 camera (e.g., via guest Wi-Fi or a compromised IoT device) captures and replays the login challenge data to forge an administrative session without credentials. They then enable a normally-hidden privileged service, force or await a device reboot to activate it, and submit crafted input to the MacTool handler to execute arbitrary commands on the camera. No public exploit code is referenced, and exploitation requires local network proximity rather than remote internet access.