FKIE_CVE-2026-1871
Vulnerability from fkie_nvd - Published: 2026-06-02 17:16 - Updated: 2026-07-22 19:10
Severity
Summary
TP-Link Tapo C200 v5 contains a stack-based buffer overflow flaw in RTSP authentication handling due to improper validation of Authorization header field lengths, which can be triggered by a crafted authentication request.
Successful exploitation causes the affected RTSP core service process to crash and triggers an automatic system reboot, resulting in a denial of service (DoS) condition. This prevents legitimate users from accessing the camera’s live video stream or management interface until the service restarts.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| tp-link | tapo_c200_firmware | 1.0.5 | |
| tp-link | tapo_c200_firmware | 1.0.12 | |
| tp-link | tapo_c200_firmware | 1.0.13 | |
| tp-link | tapo_c200_firmware | 1.0.17 | |
| tp-link | tapo_c200_firmware | 1.1.4 | |
| tp-link | tapo_c200_firmware | 1.1.8 | |
| tp-link | tapo_c200_firmware | 1.2.3 | |
| tp-link | tapo_c200_firmware | 1.3.1 | |
| tp-link | tapo_c200_firmware | 1.3.3 | |
| tp-link | tapo_c200_firmware | 1.3.5 | |
| tp-link | tapo_c200 | 5 |
{
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Tapo C200 v5",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "1.4.4 Build 260527 Rel.28339n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"source": "f23511db-6c3e-4e32-a477-6aa17d310630"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.0.5:build_240327:*:*:*:*:*:*",
"matchCriteriaId": "05C15E7C-DAED-4332-B38E-492608EA97CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.0.12:build_240527:*:*:*:*:*:*",
"matchCriteriaId": "729217F5-CB01-4B88-BDC0-4765DF737758",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.0.13:build_240619:*:*:*:*:*:*",
"matchCriteriaId": "544121C2-D1BA-4FF5-9DA8-26CD67119774",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.0.17:build_240806:*:*:*:*:*:*",
"matchCriteriaId": "950B6D8F-158C-4DC6-BDC0-6923B0836DAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.1.4:build_241219:*:*:*:*:*:*",
"matchCriteriaId": "0AA70F8C-56CA-4A9E-8BFE-4B8BE5127015",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.1.8:build_250310:*:*:*:*:*:*",
"matchCriteriaId": "800DB4F6-511D-489F-A500-CF1575A86539",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.2.3:build_250610:*:*:*:*:*:*",
"matchCriteriaId": "40E223AB-51B4-4843-A82F-32145A89CFFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.1:build_250910:*:*:*:*:*:*",
"matchCriteriaId": "98638E32-86B0-451C-96CA-E39C092CEB49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.3:build_251119:*:*:*:*:*:*",
"matchCriteriaId": "C7BC3B8D-0AAB-472A-9DC3-1FCACD246183",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.5:build_260228:*:*:*:*:*:*",
"matchCriteriaId": "340E2167-A8D1-4B17-904F-895574C9A3FF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:tp-link:tapo_c200:5:*:*:*:*:*:*:*",
"matchCriteriaId": "DF4B31A6-FDFD-41C5-9BEF-114B290CCBAE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "TP-Link Tapo C200 v5 contains a stack-based buffer overflow flaw in RTSP authentication handling due to improper validation of Authorization header field lengths, which can be triggered by a crafted authentication request.\n\nSuccessful exploitation causes the affected RTSP core service process to crash and triggers an automatic system reboot, resulting in a denial of service (DoS) condition. This prevents legitimate users from accessing the camera\u2019s live video stream or management interface until the service restarts."
},
{
"lang": "es",
"value": "TP-Link Tapo C200 v5 contiene una falla de desbordamiento de b\u00fafer basado en pila en el manejo de la autenticaci\u00f3n RTSP debido a la validaci\u00f3n incorrecta de las longitudes de los campos del encabezado de autorizaci\u00f3n, que puede ser activada por una solicitud de autenticaci\u00f3n manipulada.\n\nLa explotaci\u00f3n exitosa provoca que el proceso del servicio central RTSP afectado se bloquee y desencadena un reinicio autom\u00e1tico del sistema, lo que resulta en una condici\u00f3n de denegaci\u00f3n de servicio (DoS). Esto impide que los usuarios leg\u00edtimos accedan a la transmisi\u00f3n de video en vivo de la c\u00e1mara o la interfaz de administraci\u00f3n hasta que el servicio se reinicie."
}
],
"id": "CVE-2026-1871",
"lastModified": "2026-07-22T19:10:00.120",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-1871",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-02T18:21:22.840412Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-06-02T17:16:26.967",
"references": [
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Release Notes"
],
"url": "https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes"
},
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Release Notes"
],
"url": "https://www.tp-link.com/kr/support/download/tapo-c200/#Firmware-Release-Notes"
},
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Release Notes"
],
"url": "https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes"
},
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Vendor Advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5113/"
}
],
"sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-121"
}
],
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"type": "Secondary"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…