Read the docs
TI-2026-10908 Aliases CVE-2026-12760GHSA-25hh-rw6j-95ch

Denial-of-Service Vulnerability via Malformed IPv4 Fragmentation Handling in TP-Link Tapo C200

Priority LOW 31CWE-770Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

A denial-of-service (DoS) vulnerability has been identified in Tapo C200 v3 in the network packet handling logic due to improper handling of IPv4 fragmented packets.  An unauthenticated adjacent attacker can send crafted packets to cause excessive resource consumption, leading to instability of the device.Successful exploitation can remotely trigger a temporary denial-of-service condition, causing the camera to become unresponsive and resulting in intermittent loss of video monitoring and recording.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0036 30th percentileScored 2026-11-07
Fix Fixed Tapo C200 v3 (TP-Link Systems Inc.): 1.4.4 Build 250922

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkTapo C200 v3before 1.4.4 Build 2509221.4.4 Build 250922Patch availableCNA
  • Tapo C200 v3 VendorTP-Link Affected before 1.4.4 Build 250922 Fixed in 1.4.4 Build 250922 Patch available CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.3:build_230228:*:*:*:*:*:*1.3.3 build_230228VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.4:build_230424:*:*:*:*:*:*1.3.4 build_230424VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.5:build_230717:*:*:*:*:*:*1.3.5 build_230717VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.7:build_230920:*:*:*:*:*:*1.3.7 build_230920VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.9:build_231019:*:*:*:*:*:*1.3.9 build_231019VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.11:build_231115:*:*:*:*:*:*1.3.11 build_231115VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.13:build_240327:*:*:*:*:*:*1.3.13 build_240327VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.14:build_240513:*:*:*:*:*:*1.3.14 build_240513VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.15:build_240715:*:*:*:*:*:*1.3.15 build_240715VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.1:build_241212:*:*:*:*:*:*1.4.1 build_241212VulnerableTP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.3:build_230228:*:*:*:*:*:* Versions 1.3.3 build_230228 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.4:build_230424:*:*:*:*:*:* Versions 1.3.4 build_230424 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.5:build_230717:*:*:*:*:*:* Versions 1.3.5 build_230717 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.7:build_230920:*:*:*:*:*:* Versions 1.3.7 build_230920 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.9:build_231019:*:*:*:*:*:* Versions 1.3.9 build_231019 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.11:build_231115:*:*:*:*:*:* Versions 1.3.11 build_231115 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.13:build_240327:*:*:*:*:*:* Versions 1.3.13 build_240327 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.14:build_240513:*:*:*:*:*:* Versions 1.3.14 build_240513 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.15:build_240715:*:*:*:*:*:* Versions 1.3.15 build_240715 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.1:build_241212:*:*:*:*:*:* Versions 1.4.1 build_241212 Vulnerable ·TP-Link
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.2:build_250313:*:*:*:*:*:*1.4.2 build_250313VulnerableTP-Link
cpe:2.3:h:tp-link:tapo_c200:3:*:*:*:*:*:*:*3Running onTP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.2:build_250313:*:*:*:*:*:* Versions 1.4.2 build_250313 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:tapo_c200:3:*:*:*:*:*:*:* Versions 3 Running on ·TP-Link

Remediation

  • Fix · CNA Tapo C200 v3 (TP-Link Systems Inc.) Fixed in 1.4.4 Build 250922

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-12760
  2. 2026-10-03 Alias added: GHSA-25hh-rw6j-95ch

References

Patch 2

Advisory 1

  • TI-2021-02932 TP-LINK Tapo C200 remote code execution vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-27043 Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware… CVSS 3.1MEDIUM 4.6
  • TI-2023-11937 The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version… CVSS 3.1MEDIUM 4.6
  • TI-2026-12889 Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200 CVSS 4.0HIGH 8.7
  • TI-2025-13063 Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425 CVSS 4.0HIGH 8.7
  • TI-2025-07378 Remote Code Execution via Stack-based Buffer Overflow in ONVIF SOAP Parser in TP-Link Tapo C200 and C520WS CVSS 4.0HIGH 8.7
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences