Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-78577— Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200

Quick assessment

Affected
TP-Link Systems Inc. Tapo C200 v5
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tapo C120 v1 和 C200 V5 设备在 HTTPS 配网扫描功能中存在一个漏洞，原因是该功能缺少身份验证机制。 在完成初始设置后，同一局域网内的未认证攻击者可以调用扫描操作，并获取附近无线接入点（AP）的元数据信息，包括 SSID、BSSID、认证与加密模式以及信号强度等信息。 成功利用该漏洞可能会泄露摄像头周围无线环境的相关信息，使攻击者能够了解本地无线网络拓扑结构的组成部分。

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1590.001 · Domain Properties
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-78577

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200
Source: CVE Program / CVE List V5
Vulnerability Description
Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, an unauthenticated attacker on the same local network can invoke the scan action and retrieve nearby wireless access-point metadata, including SSIDs, BSSIDs, authentication and encryption modes, and signal-strength information. Successful exploitation may disclose information about the wireless environment surrounding the camera, allowing an attacker to learn elements of the local wireless topology.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
TP-Link Systems Inc. Tapo C200 v5 0 ~ V5_1.4.6 Build 260709 Rel.27675n -
TP-Link Systems Inc. Tapo C120 v1 0 ~ V1_1.9.4 Build 260813 Rel.79754n -

II. Public POCs for CVE-2026-78577

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-78577

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-78577 (1)

Vendor Pages for CVE-2026-78577 (2)

Same Patch Batch · TP-Link Systems Inc. · 2026-10-01 · 7 CVEs total

CVE-2026-102369 8.7 HIGH Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 &
CVE-2026-8618 7.7 HIGH Pre-Authentication Stack-based Buffer Overflow Remote Code Execution in TDDPv2 Subtype 0x9
CVE-2026-84682 7.7 HIGH TDDPv2 setProductVer Command Injection in Archer AX90
CVE-2026-9032 7.1 HIGH Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerabilit
CVE-2026-78578 7.1 HIGH Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Servic
CVE-2026-102370 5.4 MEDIUM Physical UART Access Leading to an Unauthenticated Root Shell in TP-Link Kasa EC70 and EC7

IV. Related Vulnerabilities

Same product: Tapo C200 v5
Same vendor: TP-Link Systems Inc.
Same weakness: CWE-306

V. Comments for CVE-2026-78577

No comments yet

Leave a comment