Tapo C120/C200 vulnerabilities

Tapo C120 v1 and C200 v5 cameras have a NULL pointer dereference vulnerability in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate the presence of a password field for certain parameter combinations, allowing a malformed request from the local network to crash the HTTPS service.

Tapo C120 v1 and C200 v5 cameras do not enforce authentication for HTTPS onboarding connect actions after initial setup. An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection to a different network.

Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, an unauthenticated attacker on the same local network can invoke the scan action and retrieve nearby wireless access-point metadata, including SSIDs, BSSIDs, authentication and encryption modes, and signal-strength information.

Tapo C120 v1 and C200 v5 cameras contain an improper authentication vulnerability in the login authentication verification module. An attacker on the local network can exploit weaknesses in challenge parameter validation to bypass normal authentication controls and obtain administrative session tokens. This may allow privileged management actions, unauthorized administrative access, and temporary disruption of device services (DoS).