← All reports

TP-Link Tapo C120 v1 and C200 v5 devices have vulnerabilities that allow unauthenticated attackers on the same local network to exploit them.

CybersecurityConsumer ElectronicsOct 1, 2026score 0.194 posts · 0 replies across 1 instances
This thread discusses multiple vulnerabilities in TP-Link's Tapo C120 v1 and C200 v5 devices. The issues include inadequate protection of login challenge data, missing authentication for onboarding actions, and a NULL pointer dereference in the HTTPS onboarding connect request parser. These vulnerabilities could allow unauthenticated attackers on the same local network to exploit the devices.

Claims

TP-Link Tapo C120 v1 and C200 v5 devices have vulnerabilities that allow unauthenticated attackers on the same local network to exploit them.
Parent: Consumer ElectronicsEntity: TP-Link Tapo C120 v1 and C200 v5Impact: negativeDate: Oct 1, 2026Target: TP-Link's security measures for the Tapo C120 v1 and C200 v5 devices

Source posts

@[email protected]
🚨 EUVD-2026-90983 📊 Score: 8.7/10 (CVSS v3.1) 📦 Product: Tapo C200 v5, Tapo C120 v1 🏢 Vendor: TP-Link Systems Inc. 📅 Updated: 2026-10-01 📝 Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge d... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90983 #cybersecurity #infosec #euvd #cve #vulnerability
1 boosts · 0 favs · 0 replies · Oct 1, 2026
#cybersecurity#infosec#euvd#cve#vulnerability
@[email protected]
🚨 EUVD-2026-90982 📊 Score: 7.1/10 (CVSS v3.1) 📦 Product: Tapo C120 v1, Tapo C200 v5 🏢 Vendor: TP-Link Systems Inc. 📅 Updated: 2026-10-01 📝 Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup. An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causin... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90982 #cybersecurity #infosec #euvd #cve #vulnerability
1 boosts · 0 favs · 0 replies · Oct 1, 2026
#cybersecurity#infosec#euvd#cve#vulnerability
@[email protected]
🚨 EUVD-2026-90981 📊 Score: 5.3/10 (CVSS v3.1) 📦 Product: Tapo C120 v1, Tapo C200 v5 🏢 Vendor: TP-Link Systems Inc. 📅 Updated: 2026-10-01 📝 Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, an unauthenticated attacker on the same local network can invoke the scan action and re... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90981 #cybersecurity #infosec #euvd #cve #vulnerability
1 boosts · 0 favs · 0 replies · Oct 1, 2026
#cybersecurity#infosec#euvd#cve#vulnerability
@[email protected]
🚨 EUVD-2026-90980 📊 Score: 7.1/10 (CVSS v3.1) 📦 Product: Tapo C200 v5, Tapo C120 v1 🏢 Vendor: TP-Link Systems Inc. 📅 Updated: 2026-10-01 📝 Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate that a password field is ... 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-90980 #cybersecurity #infosec #euvd #cve #vulnerability
1 boosts · 0 favs · 0 replies · Oct 1, 2026
#cybersecurity#infosec#euvd#cve#vulnerability