CVE-2026-15315
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Tapo C120 v1 and C200 v5 cameras contain an improper authentication vulnerability in the login authentication verification module. An attacker on the local network can exploit weaknesses in challenge parameter validation to bypass normal authentication controls and obtain administrative session tokens. This may allow privileged management actions, unauthorized administrative access, and temporary disruption of device services (DoS).
Risk Assessment
An attacker on the local network can gain administrative control over the camera, potentially leading to privacy breaches, unauthorized configuration changes, and disruption of surveillance.
Recommendation
Update the firmware of Tapo cameras to the latest available version that includes security fixes, and limit trust in the local network.
Other vulnerabilities in Tapo C120/C200
See all- CVE-2026-9032High
Tapo C120 v1 and C200 v5 cameras have a NULL pointer dereference vulnerability in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate the presence of a password field for certain parameter combinations, allowing a malformed request from the local network to crash the HTTPS service.
- CVE-2026-78578High
Tapo C120 v1 and C200 v5 cameras do not enforce authentication for HTTPS onboarding connect actions after initial setup. An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection to a different network.
- CVE-2026-78577Medium
Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, an unauthenticated attacker on the same local network can invoke the scan action and retrieve nearby wireless access-point metadata, including SSIDs, BSSIDs, authentication and encryption modes, and signal-strength information.
Original NVD description (English source)
Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module. An attacker on the local network can exploit weaknesses in challenge parameter validation to bypass normal authentication controls and obtain administrative session tokens. Successful exploitation may allow an attacker to subsequently execute privileged management actions, enable unauthorized administrative access and temporary disruption of device services, resulting in a denial-of-service (DoS) condition.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS