CVE-2026-78578
Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect…
- Risk score
- 46/100
- CVSS
- 7.1 v4.0
- Exploit chance (30 days)
- 0.2%
- Published
- 1 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup. An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection to a different network. Successful exploitation disconnects…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.1 high
References
- https://www.tp-link.com/en/support/download/tapo-c120/v1.26/#Firmware-Release-Notes
- https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/download/tapo-c120/v1.26/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/faq/5321/
Original description
Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup. An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection to a different network. Successful exploitation disconnects the camera from its intended wireless network, making it unreachable on its management address, resulting in a denial-of-service condition.
Last activity 1 Oct 2026. Patch Forecast updates every hour.