High severity · published Oct 1, 2026
CVE-2026-78578
Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup.  An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection to a different network. Successful exploitation disconnects the camera from its intended wireless network, making it unreachable on its management address, resulting in a denial-of-service condition.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TC
Tapo C120 v1 · TP-Link Systems Inc.
before V1_1.9.4 Build 260813 Rel.79754n · source: vendor
TC
Tapo C200 v5 · TP-Link Systems Inc.
before V5_1.4.6 Build 260709 Rel.27675n · source: vendor
Affected product
TC
Tapo C120 v1
TP-Link Systems Inc.
More from Tapo C120 v1
8.8
CVE-2026-15315
Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200
8.7
CVE-2026-102369
Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200
7.1
CVE-2026-9032
Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerability in TP-Link Tapo C120 & C200
5.3
CVE-2026-78577
Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200