TP-Link Tapo C200 Firmware
11 CVEs affecting TP-Link Tapo C200 Firmware. Latest disclosed: 2026-08-18. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-4045 | Critical | 9.8 | 2022-03-10 | TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary runnin… |
CVE-2026-15315 | High | 8.8 | 2026-08-18 | Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module. An attacker on the local network… |
CVE-2025-14300 | High | 8.1 | 2025-12-20 | The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the s… |
CVE-2026-15316 | Medium | 6.5 | 2026-08-18 | An improper input validation vulnerability in the configuration service for processing encrypted credential data has been identified in Tapo C200 v5. An attac… |
CVE-2026-12760 | Medium | 6.5 | 2026-06-24 | A denial-of-service (DoS) vulnerability has been identified in Tapo C200 v3 in the network packet handling logic due to improper handling of IPv4 fragmented pa… |
CVE-2026-1871 | Medium | 6.5 | 2026-06-02 | TP-Link Tapo C200 v5 contains a stack-based buffer overflow flaw in RTSP authentication handling due to improper validation of Authorization header field lengt… |
CVE-2025-8065 | Medium | 6.5 | 2025-12-20 | A stack-based buffer overflow vulnerability was identified in the ONVIF SOAP XML Parser in Tapo C200 v3 and C520WS v2.6. When processing XML tags with namespac… |
CVE-2025-14299 | Medium | 6.5 | 2025-12-20 | The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on th… |
CVE-2020-11445 | Medium | 5.3 | 2020-04-01 | TP-Link cloud cameras through 2020-02-09 allow remote attackers to bypass authentication and obtain sensitive information via vectors involving a Wi-Fi session… |
CVE-2023-49515 | Medium | 4.6 | 2024-01-17 | Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware v.1.3.4 and fixed in v.1.3.11 allows a physically proximate attacker to ob… |
CVE-2023-27126 | Medium | 4.6 | 2023-06-06 | The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused across all cameras. An attacker with physica… |