Vulnerabilities

TI-2026-12890 CVE-2026-15316 · GHSA-5fvx-mqqx-vrm4

Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200

LOW 31

An improper input validation vulnerability in the configuration service for processing encrypted credential data has been identified in Tapo C200 v5.

CVSS 4.0HIGH 7.1 Adjacent network No auth No interaction EPSS 0.00334 Published 2026-08-18 Fixed in V5_1.4.6 Build 260709 Rel.27675n CWE-20

TI-2026-12889 CVE-2026-15315 · GHSA-xw5g-644p-8357

Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200

MEDIUM 40

Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module.

CVSS 4.0HIGH 8.7 Adjacent network No auth No interaction EPSS 0.00462 Published 2026-08-18 Fixed in V5_1.4.6 Build 260709 Rel.27675n, 1.9.3 Build 260521 CWE-287

Vulnerabilities

Filters

Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200

Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200