Medium severity · published Aug 18, 2026
CVE-2026-15316
Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
An improper input
validation vulnerability in the configuration service for processing encrypted
credential data has been identified in Tapo C200 v5. An attacker can send oversized crypted
ciphertext values that may trigger exception handling failures, due to insufficient
validation, causing the affected device to crash or restart.
Successful
exploitation may temporarily disrupt HTTPS management and monitoring
functionality, resulting in a denial-of-service (DoS) condition until the
service recovers.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TC
Tapo C200 v5 · TP-Link Systems Inc.
before V5_1.4.6 Build 260709 Rel.27675n · source: vendor
TC
Tapo C200 Firmware · Tp-link
before 1.4.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-15316
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-15316
Product
https://www.tp-link.com/en/support/download/tapo-c200/v5/
Product
https://www.tp-link.com/us/support/download/tapo-c200/v5/
Vendor Advisory
https://www.tp-link.com/us/support/faq/5248/
More from Tapo C200 v5
8.8
CVE-2026-15315
Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200
8.7
CVE-2026-102369
Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200
7.1
CVE-2026-78578
Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200
7.1
CVE-2026-9032
Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerability in TP-Link Tapo C120 & C200
6.5
CVE-2026-1871
Authenticated Stack-based Buffer Overflow in RTSP Authentication of Tapo C200
