Read the docs
TI-2026-01541 Aliases CVE-2026-1871GHSA-92jw-rf4g-rwr2

Authenticated Stack-based Buffer Overflow in RTSP Authentication of Tapo C200

Priority LOW 31CWE-121Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

TP-Link Tapo C200 v5 contains a stack-based buffer overflow flaw in RTSP authentication handling due to improper validation of Authorization header field lengths, which can be triggered by a crafted authentication request. Successful exploitation causes the affected RTSP core service process to crash and triggers an automatic system reboot, resulting in a denial of service (DoS) condition. This prevents legitimate users from accessing the camera’s live video stream or management interface until the service restarts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00305 23rd percentileScored 2026-11-07
Fix Fixed Tapo C200 v5 (TP-Link Systems Inc.): 1.4.4 Build 260527 Rel.28339n

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkTapo C200 v5before 1.4.4 Build 260527 Rel.28339n1.4.4 Build 260527 Rel.28339nPatch availableCNA
  • Tapo C200 v5 VendorTP-Link Affected before 1.4.4 Build 260527 Rel.28339n Fixed in 1.4.4 Build 260527 Rel.28339n Patch available CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:tapo_c200_firmware:1.0.5:build_240327:*:*:*:*:*:*1.0.5 build_240327VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.0.12:build_240527:*:*:*:*:*:*1.0.12 build_240527VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.0.13:build_240619:*:*:*:*:*:*1.0.13 build_240619VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.0.17:build_240806:*:*:*:*:*:*1.0.17 build_240806VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.1.4:build_241219:*:*:*:*:*:*1.1.4 build_241219VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.1.8:build_250310:*:*:*:*:*:*1.1.8 build_250310VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.2.3:build_250610:*:*:*:*:*:*1.2.3 build_250610VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.1:build_250910:*:*:*:*:*:*1.3.1 build_250910VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.3:build_251119:*:*:*:*:*:*1.3.3 build_251119VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.5:build_260228:*:*:*:*:*:*1.3.5 build_260228VulnerableTP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.0.5:build_240327:*:*:*:*:*:* Versions 1.0.5 build_240327 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.0.12:build_240527:*:*:*:*:*:* Versions 1.0.12 build_240527 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.0.13:build_240619:*:*:*:*:*:* Versions 1.0.13 build_240619 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.0.17:build_240806:*:*:*:*:*:* Versions 1.0.17 build_240806 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.1.4:build_241219:*:*:*:*:*:* Versions 1.1.4 build_241219 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.1.8:build_250310:*:*:*:*:*:* Versions 1.1.8 build_250310 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.2.3:build_250610:*:*:*:*:*:* Versions 1.2.3 build_250610 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.1:build_250910:*:*:*:*:*:* Versions 1.3.1 build_250910 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.3:build_251119:*:*:*:*:*:* Versions 1.3.3 build_251119 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.5:build_260228:*:*:*:*:*:* Versions 1.3.5 build_260228 Vulnerable ·TP-Link
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:tp-link:tapo_c200:5:*:*:*:*:*:*:*5Running onTP-Link
  • cpe:2.3:h:tp-link:tapo_c200:5:*:*:*:*:*:*:* Versions 5 Running on ·TP-Link

Remediation

  • Fix · CNA Tapo C200 v5 (TP-Link Systems Inc.) Fixed in 1.4.4 Build 260527 Rel.28339n

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-1871
  2. 2026-10-03 Alias added: GHSA-92jw-rf4g-rwr2

References

Patch 3

Advisory 1

  • TI-2021-02932 TP-LINK Tapo C200 remote code execution vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-27043 Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware… CVSS 3.1MEDIUM 4.6
  • TI-2023-11937 The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version… CVSS 3.1MEDIUM 4.6
  • TI-2026-12889 Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200 CVSS 4.0HIGH 8.7
  • TI-2025-13063 Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425 CVSS 4.0HIGH 8.7
  • TI-2025-07378 Remote Code Execution via Stack-based Buffer Overflow in ONVIF SOAP Parser in TP-Link Tapo C200 and C520WS CVSS 4.0HIGH 8.7
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences