Authentication Bypass Vulnerability in Tapo Cameras by TP-Link

CVE-2026-78578

What is CVE-2026-78578?

The TP-Link Tapo C120 and C200 cameras are vulnerable due to a failure to enforce authentication for specific HTTPS onboarding actions after initial setup. This vulnerability allows an unauthenticated adjacent attacker to exploit the do method to submit unauthorized wireless configuration parameters, facilitating the connection of the camera to a different network. Such exploitation results in the camera losing access to its intended wireless network, rendering it unreachable on its management interface and leading to a denial-of-service condition.

References