Medium severity · published Jun 6, 2023
CVE-2023-27126
The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused across all cameras
4.6
CVSS
0.4%
EPSS
No
On KEV
Description
The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused across all cameras. An attacker with physical access to a camera is able to extract and decrypt sensitive data containing the Wifi password and the TP-LINK account credential of the victim.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TC
Tapo C200 Firmware · Tp-link
1.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-27126
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-27126
Exploit
https://www.claranet.fr/blog/dans-les-entrailles-dune-camera-connectee-tp-link-14
More from Tapo C200 Firmware
9.8
CVE-2021-4045
TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root
8.8
CVE-2026-15315
Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200
8.1
CVE-2025-14300
Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425
6.5
CVE-2026-15316
Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200
6.5
CVE-2026-12760
Denial-of-Service Vulnerability via Malformed IPv4 Fragmentation Handling in TP-Link Tapo C200