Vulnerability details
CVE-2026-15315
TP-Link Systems Tapo C120 v1TP-Link Systems Tapo C200 v5
Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200
CVSS 4.0
8.7High
Official description
Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module. An attacker on the local network can exploit weaknesses in challenge parameter validation to bypass normal authentication controls and obtain administrative session tokens. Successful exploitation may allow an attacker to subsequently execute privileged management actions, enable unauthorized administrative access and temporary disruption of device services, resulting in a denial-of-service (DoS) condition.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.7High | 4.0 | CVEProject cvelistV5 (CNA) (TPLink) | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| TP-Link Systems Inc. | Tapo C120 v1 | v < 1.9.3 Build 260521 | CVEProject cvelistV5 (CNA) |
| TP-Link Systems Inc. | Tapo C200 v5 | v < V5_1.4.6 Build 260709 Rel.27675n | CVEProject cvelistV5 (CNA) |
References and advisories
5- https://www.tp-link.com/us/support/download/tapo-c200/v5/ patch
- https://www.tp-link.com/en/support/download/tapo-c200/v5/ patch
- https://www.tp-link.com/us/support/faq/5248/ vendor-advisory
- https://www.tp-link.com/us/support/download/tapo-c120/v1.26/#Firmware-Release-Notes patch
- https://www.tp-link.com/en/support/download/tapo-c120/v1.26/#Firmware-Release-Notes patch
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-08-19
- Last updated
- 2026-08-28
- State
- Published
- Assigner (CNA)
- TPLink
Exploit prediction (EPSS)
0.46%
Probability of exploitation in 30 days
40.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-287Improper Authentication