CVE-2026-102369
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service that becomes accessible after a reboot, and submit crafted input to execute arbitrary commands within the device management process.
Risk Assessment
Successful exploitation may allow arbitrary command execution on the camera and compromise the confidentiality, integrity, and availability of the affected device. Exploitation requires access from the same local network, replay of the login challenge data, activation of the privileged service, and a device reboot.
Recommendation
Update Tapo C120 v1 and C200 V5 firmware to the latest version provided by the vendor. Restrict camera access from untrusted local network segments.
Related vulnerabilities
- CVE-2026-94075Critical
The WordPress plugin Newsletters (newsletters-lite) up to version 4.18.1 contains a deserialization of untrusted data vulnerability, allowing object injection. This could enable an attacker to execute unintended code.
- CVE-2026-114196Critical
The WordPress plugin Paytium up to version 5.0.5 is vulnerable to deserialization of untrusted data, allowing object injection. This may enable an attacker to perform unauthorized actions.
- CVE-2026-112866Critical
The WordPress plugin Product Filter by WBW (woo-product-filter) up to version 3.4.6 is vulnerable to blind SQL injection due to improper neutralization of special elements in SQL commands. An attacker could exploit this to manipulate database queries.
- CVE-2026-111402Critical
The WordPress plugin Newsletters (newsletters-lite) up to version 4.18.1 is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. This could allow an attacker to execute arbitrary SQL queries.
- CVE-2026-115806Critical
The Prime Mover – Backup and Migration plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.2.1 via deserialization of untrusted input in the migration search-and-replace routine. An unauthenticated attacker can store a crafted, base64-encoded serialized object in wp_comments.comment_content through the standard comment-submission endpoint. When an administrator performs a routine export or restore, the plugin base64-decodes that stored value and passes it to unserialize() with no allowed_classes restriction. A Property-Oriented Programming (POP) chain is present in the plugin's own bundled Freemius library, so no additional plugin or theme is required.
- CVE-2026-115931Critical
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels, but the backend did not restrict which functions could be requested, allowing calls to internal helpers. One helper reads a file from the server's disk (e.g., environment file with the session signing secret, database address, and service credentials), and another makes the backend process exit with a single request. Self-registration is open by default, so no existing account or action by another user is needed.
- CVE-2026-115893Critical
Wasmtime prior to 36.0.19, 48.0.7, and 49.0.4 has a flaw in the Cranelift compiler on aarch64. A br_table instruction with more than ~256,000 targets can be miscompiled, allowing a jump to arbitrary code and sandbox escape.
- CVE-2026-115889Critical
Wasmtime prior to 36.0.19 and 43.0.0 has a flaw in the Cranelift compiler where SSA value indices can silently overflow when compiling large Wasm functions. This can cause miscompilation, type confusion, and sandbox escape.
- CVE-2026-115812Critical
A relative path traversal during model archive extraction in AWS Multi Model Server 1.1.11 and earlier allows remote actors to execute arbitrary code via a crafted model archive. The project is end of life and no fixed version is available.
- CVE-2026-55486Critical
In Goobi viewer from version 25.08 to before 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token accept an origin query parameter without validation and embed it into the Content-Security-Policy header and an HTML response body as a postMessage argument. Since the attacker controls both calls, the unescaped value yields reflected XSS.
Original NVD description (English source)
Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service that becomes accessible after a reboot, and submit crafted input to execute arbitrary commands within the device management process. Successful exploitation may allow arbitrary command execution on the camera and compromise the confidentiality, integrity, and availability of the affected device. Exploitation requires access from the same local network, replay of the login challenge data, activation of the privileged service, and a device reboot.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS