Strix
75K

CVE-2026-78578

HIGHCVSS 7.1/10

Last modified

CVE-2026-78578 is a high-severity vulnerability rated 7.1/10 on the CVSS scale. Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup.  An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection to a different network. Successful exploitation disconnects the camera from its intended wireless network, making it unreachable on its management address, resulting in a denial-of-service condition..

Description

Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup.  An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection to a different network. Successful exploitation disconnects the camera from its intended wireless network, making it unreachable on its management address, resulting in a denial-of-service condition.

Metrics

CVSS 4.0
7.1/10

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
TP-Link Systems Inc.Tapo C200 v5< V5_1.4.6 Build 260709 Rel.27675n
TP-Link Systems Inc.Tapo C120 v1< V1_1.9.4 Build 260813 Rel.79754n

References

Timeline

Published
Last Modified
Status
Deferred

Frequently Asked Questions

What is CVE-2026-78578?
Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup.  An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection to a different network. Successful exploitation disconnects the camera from its intended wireless network, making it unreachable on its management address, resulting in a denial-of-service condition.
How severe is CVE-2026-78578?
CVE-2026-78578 has a CVSS score of 7.1/10 (HIGH severity).
How do I fix CVE-2026-78578?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-78578?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST