Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-78578— Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200

Quick assessment

Affected
TP-Link Systems Inc. Tapo C200 v5
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tapo C120 v1 和 C200 v5 在初始设置完成后，未对通过 HTTPS 进行的 方法（用于设备接入/配置）实施身份验证。未经认证的相邻攻击者可以提交未授权的无线配置参数，导致摄像头尝试连接到其他网络。 成功利用该漏洞会使摄像头从其预期的无线网络中断开连接，导致其管理地址不可达，从而造成拒绝服务（DoS）状态。

CVSS 7.1 · High EPSS 0.25% · P15

Affected Version Matrix 2

VendorProduct Version RangeStatus
TP-Link Systems Inc. Tapo C120 v1 < V1_1.9.4 Build 260813 Rel.79754n affected
TP-Link Systems Inc. Tapo C200 v5 < V5_1.4.6 Build 260709 Rel.27675n affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-78578

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200
Source: CVE Program / CVE List V5
Vulnerability Description
Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup.  An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection to a different network. Successful exploitation disconnects the camera from its intended wireless network, making it unreachable on its management address, resulting in a denial-of-service condition.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
TP-Link Systems Inc. Tapo C200 v5 0 ~ V5_1.4.6 Build 260709 Rel.27675n -
TP-Link Systems Inc. Tapo C120 v1 0 ~ V1_1.9.4 Build 260813 Rel.79754n -

II. Public POCs for CVE-2026-78578

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-78578

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-78578 (1)

Vendor Pages for CVE-2026-78578 (2)

Same Patch Batch · TP-Link Systems Inc. · 2026-10-01 · 7 CVEs total

CVE-2026-102369 8.7 HIGH Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 &
CVE-2026-8618 7.7 HIGH Pre-Authentication Stack-based Buffer Overflow Remote Code Execution in TDDPv2 Subtype 0x9
CVE-2026-84682 7.7 HIGH TDDPv2 setProductVer Command Injection in Archer AX90
CVE-2026-9032 7.1 HIGH Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerabilit
CVE-2026-102370 5.4 MEDIUM Physical UART Access Leading to an Unauthenticated Root Shell in TP-Link Kasa EC70 and EC7
CVE-2026-78577 5.3 MEDIUM Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200

IV. Related Vulnerabilities

Same product: Tapo C200 v5
Same vendor: TP-Link Systems Inc.
Same weakness: CWE-306

V. Comments for CVE-2026-78578

No comments yet

Leave a comment