Authentication Bypass in Tapo Cameras by TP-Link
CVE-2026-78577
5.3MEDIUM
Key Information:
- Vendor
Tp-link Systems Inc.
- Status
- Vendor
- CVE Published:
- 1 October 2026
What is CVE-2026-78577?
The Tapo C120 and C200 cameras from TP-Link exhibit a critical flaw in their HTTPS onboarding scan function, allowing unauthenticated attackers on the same local network to invoke scans. This vulnerability permits attackers to gather sensitive information about nearby wireless access points, including SSIDs, BSSIDs, encryption methods, and signal strength. The exploitation of this vulnerability could enable an attacker to map the local wireless topology, raising significant security concerns for affected users.
Affected Version(s)
Tapo C120 v1 0
Tapo C200 v5 0
References
CVSS V4
Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Thai Do (Lio) and Khoi Tran (KayTii) from OPSWAT