Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-102369— Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200

Quick assessment

Affected
TP-Link Systems Inc. Tapo C200 v5
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tapo C120 v1 和 C200 V5 未能充分保护登录挑战数据，也未对由 MacTool 处理器处理的攻击者可控输入进行有效净化。同一局域网内的未认证攻击者可重放登录挑战数据，从而获取管理员会话；启用一个在设备重启后变得可访问的特权服务；并提交精心构造的输入，以在设备管理进程中执行任意命令。 成功利用该漏洞可能导致在摄像头设备上执行任意命令，进而影响受影响设备的机密性、完整性和可用性。利用该漏洞需要从同一局域网发起访问、重放登录挑战数据、激活特权服务，并重启设备。

CVSS 8.7 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-102369

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200
Source: CVE Program / CVE List V5
Vulnerability Description
Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service that becomes accessible after a reboot, and submit crafted input to execute arbitrary commands within the device management process. Successful exploitation may allow arbitrary command execution on the camera and compromise the confidentiality, integrity, and availability of the affected device. Exploitation requires access from the same local network, replay of the login challenge data, activation of the privileged service, and a device reboot.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
TP-Link Systems Inc. Tapo C200 v5 0 ~ V5_1.4.6 Build 260709 Rel.27675n -
TP-Link Systems Inc. Tapo C120 v1 0 ~ V1_1.9.4 Build 260813 Rel.79754n -

II. Public POCs for CVE-2026-102369

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-102369

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-102369 (1)

Vendor Pages for CVE-2026-102369 (2)

Same Patch Batch · TP-Link Systems Inc. · 2026-10-01 · 7 CVEs total

CVE-2026-8618 7.7 HIGH Pre-Authentication Stack-based Buffer Overflow Remote Code Execution in TDDPv2 Subtype 0x9
CVE-2026-84682 7.7 HIGH TDDPv2 setProductVer Command Injection in Archer AX90
CVE-2026-9032 7.1 HIGH Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerabilit
CVE-2026-78578 7.1 HIGH Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Servic
CVE-2026-102370 5.4 MEDIUM Physical UART Access Leading to an Unauthenticated Root Shell in TP-Link Kasa EC70 and EC7
CVE-2026-78577 5.3 MEDIUM Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200

IV. Related Vulnerabilities

Same product: Tapo C200 v5
Same vendor: TP-Link Systems Inc.
Same weakness: CWE-287

V. Comments for CVE-2026-102369

No comments yet

Leave a comment