<?xml version='1.0' encoding='UTF-8'?>
<?xml-stylesheet href="/static/style.xsl" type="text/xsl"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title>Most recent entries from all</title>
    <link>https://vulnerability.circl.lu</link>
    <description>Contains only the most 10 recent entries.</description>
    <docs>http://www.rssboard.org/rss-specification</docs>
    <generator>python-feedgen</generator>
    <language>en</language>
    <lastBuildDate>Fri, 02 Oct 2026 17:41:52 +0000</lastBuildDate>
    <item>
      <title>CVE-2026-15315 — Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200</title>
      <link>https://vulnerability.circl.lu/vuln/cve-2026-15315</link>
      <description>&lt;p&gt;&lt;strong&gt;Affected:&lt;/strong&gt; TP-Link Systems Inc. Tapo C200 v5, TP-Link Systems Inc Tapo C120 v1&lt;/p&gt;
&lt;p&gt;Tapo C120 v1 and C200 v5
contain an improper authentication vulnerability within the login
authentication verification module. An attacker on the local network can
exploit weaknesses in challenge parameter validation to bypass normal
authentication controls and obtain administrative session tokens.&lt;/p&gt;
&lt;p&gt;Successful
exploitation may allow an attacker to subsequently execute privileged
management actions, enable unauthorized administrative access and temporary
disruption of device services, resulting in a denial-of-service (DoS)
condition.&lt;/p&gt;</description>
      <content:encoded>&lt;p&gt;&lt;strong&gt;Affected:&lt;/strong&gt; TP-Link Systems Inc. Tapo C200 v5, TP-Link Systems Inc Tapo C120 v1&lt;/p&gt;
&lt;p&gt;Tapo C120 v1 and C200 v5
contain an improper authentication vulnerability within the login
authentication verification module. An attacker on the local network can
exploit weaknesses in challenge parameter validation to bypass normal
authentication controls and obtain administrative session tokens.&lt;/p&gt;
&lt;p&gt;Successful
exploitation may allow an attacker to subsequently execute privileged
management actions, enable unauthorized administrative access and temporary
disruption of device services, resulting in a denial-of-service (DoS)
condition.&lt;/p&gt;</content:encoded>
      <guid isPermaLink="false">https://vulnerability.circl.lu/vuln/cve-2026-15315</guid>
    </item>
  </channel>
</rss>
