High severity · published Oct 1, 2026
CVE-2026-78578
Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
Tapo C120 v1 and C200 v5
do not enforce authentication for do method HTTPS onboarding connect actions
after initial setup. An unauthenticated adjacent
attacker can submit unauthorized wireless configuration parameters, causing the
camera to attempt connection to a different network.
Successful
exploitation disconnects the camera from its intended wireless network, making
it unreachable on its management address, resulting in a denial-of-service
condition.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TC
Tapo C120 v1 · TP-Link Systems Inc.
before V1_1.9.4 Build 260813 Rel.79754n · source: vendor
TC
Tapo C200 v5 · TP-Link Systems Inc.
before V5_1.4.6 Build 260709 Rel.27675n · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-78578
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-78578
patch
https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes
patch
https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes
patch
https://www.tp-link.com/us/support/download/tapo-c120/v1.26/#Firmware-Release-Notes
patch
https://www.tp-link.com/en/support/download/tapo-c120/v1.26/#Firmware-Release-Notes
vendor-advisory
https://www.tp-link.com/us/support/faq/5321/
More from Tapo C120 v1
8.8
CVE-2026-15315
Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200
8.7
CVE-2026-102369
Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200
7.1
CVE-2026-9032
Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerability in TP-Link Tapo C120 & C200
5.3
CVE-2026-78577
Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200
