Read the docs
TI-2021-02932 Aliases CVE-2021-4045GHSA-574v-3xxh-gwh5

TP-LINK Tapo C200 remote code execution vulnerability

Priority HIGH 80CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-77.

Summary

TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root. The exploitation of this vulnerability allows an attacker to take full control of the camera.

Why it matters now

EPSS 0.72376 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkTapo C2001.15 – 1.15—No fix listedCNA
  • Tapo C200 VendorTP-Link Affected 1.15 – 1.15 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:tapo_c200_firmware:*:*:*:*:*:*:*:*up to 1.1.15VulnerableTP-Link
cpe:2.3:h:tp-link:tapo_c200:-:*:*:*:*:*:*:*not specified by NVDRunning onTP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:*:*:*:*:*:*:*:* Versions up to 1.1.15 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:tapo_c200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·TP-Link

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-4045
  2. 2026-10-03 Alias added: GHSA-574v-3xxh-gwh5

References

Exploit 1

Advisory 1

  • TI-2023-27043 Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware… CVSS 3.1MEDIUM 4.6
  • TI-2023-11937 The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version… CVSS 3.1MEDIUM 4.6
  • TI-2026-12889 Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200 CVSS 4.0HIGH 8.7
  • TI-2025-13063 Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425 CVSS 4.0HIGH 8.7
  • TI-2025-07378 Remote Code Execution via Stack-based Buffer Overflow in ONVIF SOAP Parser in TP-Link Tapo C200 and C520WS CVSS 4.0HIGH 8.7
  • TI-2026-12890 Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200 CVSS 4.0HIGH 7.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences