Tapo C120 V1
Monthly
Command execution and administrative-session bypass in TP-Link Tapo C120 v1 and C200 V5 cameras let an unauthenticated attacker on the same local network replay login challenge data, enable a privileged service that becomes reachable after reboot, and inject commands via the MacTool handler. The vendor reports a patch is available, and no public exploit code or CISA KEV active-exploitation entry was identified at time of analysis. Our independent assessment rates this as a credible, above-average-priority issue but not a drop-everything emergency because the attack requires same-LAN access, successful challenge replay, service activation, and a reboot.
Denial of service in TP-Link Tapo C120 v1 and C200 v5 cameras allows an unauthenticated attacker on an adjacent network segment to overwrite the device's wireless onboarding parameters and force it to join a different network, after which the camera becomes unreachable at its management address. The root cause is a missing-authentication condition (CWE-306) in the HTTPS onboarding 'do' method connect actions that persists after initial setup, so no credentials and no user interaction are required, although exploitation is limited to attackers on the same local or wireless segment and the outcome is availability-only with no confidentiality or integrity impact. No public exploit identified at time of analysis, and a vendor firmware update addressing the issue is available per TP-Link's advisory and download pages.
Denial of service affecting TP-Link Tapo C120 v1 and C200 v5 security cameras, where a malformed HTTPS onboarding connect request that omits the password field for certain authentication and encryption parameter combinations triggers a NULL pointer dereference (CWE-476) in the request parser and crashes the HTTPS management service. The endpoint is reachable without authentication once the device has completed initial setup, but attackers must already sit on the same local network segment (CVSS 4.0 vector AV:A/PR:N, assessed equivalent CVSS 3.1 AV:A/AC:L/PR:N/UI:N with availability-only impact), so internet-facing exposure is not the default scenario. Impact is confined to temporary loss of HTTPS management functions, with sustained outages requiring repeated malformed requests and some cases necessitating a manual device reboot; no public exploit code was identified at time of analysis and no CISA KEV entry exists, and the vendor has published firmware release notes addressing the flaw.
Unauthenticated devices on the same local network segment as a TP-Link Tapo C120 v1 or Tapo C200 V5 camera can invoke the HTTPS onboarding scan function and pull back metadata about nearby wireless access points, including SSIDs, BSSIDs, authentication and encryption modes, and signal-strength readings (CWE-306, missing authentication for a critical function). The flaw is only reachable after the camera has completed initial setup and requires the attacker to already have adjacent-network access (CVSS:4.0 AV:A/PR:N/UI:N, base 5.3; our own assessment scores it CVSS:3.1 3.1 AV:A/AC:L/PR:N/UI:N with C:L only), so it is not internet-exploitable and yields reconnaissance-grade wireless topology data rather than code execution, credential theft, or camera/video access. There is no KEV listing and no public exploit identified at time of analysis, and TP-Link has published firmware updates for both hardware revisions. This is a genuine but low-to-moderate priority issue, not a critical one, and the practical risk depends entirely on how hostile or shared the camera's LAN/Wi-Fi segment is.
Command execution and administrative-session bypass in TP-Link Tapo C120 v1 and C200 V5 cameras let an unauthenticated attacker on the same local network replay login challenge data, enable a privileged service that becomes reachable after reboot, and inject commands via the MacTool handler. The vendor reports a patch is available, and no public exploit code or CISA KEV active-exploitation entry was identified at time of analysis. Our independent assessment rates this as a credible, above-average-priority issue but not a drop-everything emergency because the attack requires same-LAN access, successful challenge replay, service activation, and a reboot.
Denial of service in TP-Link Tapo C120 v1 and C200 v5 cameras allows an unauthenticated attacker on an adjacent network segment to overwrite the device's wireless onboarding parameters and force it to join a different network, after which the camera becomes unreachable at its management address. The root cause is a missing-authentication condition (CWE-306) in the HTTPS onboarding 'do' method connect actions that persists after initial setup, so no credentials and no user interaction are required, although exploitation is limited to attackers on the same local or wireless segment and the outcome is availability-only with no confidentiality or integrity impact. No public exploit identified at time of analysis, and a vendor firmware update addressing the issue is available per TP-Link's advisory and download pages.
Denial of service affecting TP-Link Tapo C120 v1 and C200 v5 security cameras, where a malformed HTTPS onboarding connect request that omits the password field for certain authentication and encryption parameter combinations triggers a NULL pointer dereference (CWE-476) in the request parser and crashes the HTTPS management service. The endpoint is reachable without authentication once the device has completed initial setup, but attackers must already sit on the same local network segment (CVSS 4.0 vector AV:A/PR:N, assessed equivalent CVSS 3.1 AV:A/AC:L/PR:N/UI:N with availability-only impact), so internet-facing exposure is not the default scenario. Impact is confined to temporary loss of HTTPS management functions, with sustained outages requiring repeated malformed requests and some cases necessitating a manual device reboot; no public exploit code was identified at time of analysis and no CISA KEV entry exists, and the vendor has published firmware release notes addressing the flaw.
Unauthenticated devices on the same local network segment as a TP-Link Tapo C120 v1 or Tapo C200 V5 camera can invoke the HTTPS onboarding scan function and pull back metadata about nearby wireless access points, including SSIDs, BSSIDs, authentication and encryption modes, and signal-strength readings (CWE-306, missing authentication for a critical function). The flaw is only reachable after the camera has completed initial setup and requires the attacker to already have adjacent-network access (CVSS:4.0 AV:A/PR:N/UI:N, base 5.3; our own assessment scores it CVSS:3.1 3.1 AV:A/AC:L/PR:N/UI:N with C:L only), so it is not internet-exploitable and yields reconnaissance-grade wireless topology data rather than code execution, credential theft, or camera/video access. There is no KEV listing and no public exploit identified at time of analysis, and TP-Link has published firmware updates for both hardware revisions. This is a genuine but low-to-moderate priority issue, not a critical one, and the practical risk depends entirely on how hostile or shared the camera's LAN/Wi-Fi segment is.