CVE-2026-102369 (GCVE-0-2026-102369)
Vulnerability from cvelistv5
Published
2026-10-01 17:42
Modified
2026-10-01 18:08
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-287 - Improper Authentication
Summary
Tapo C120 v1 and C200 V5
do not adequately protect login challenge data or sanitize
attacker-controlled input processed by the MacTool handler. An unauthenticated
attacker on the same local network can replay login challenge data to obtain an
administrative session, enable a privileged service that becomes accessible
after a reboot, and submit crafted input to execute arbitrary commands within
the device management process.
Successful
exploitation may allow arbitrary command execution on the camera and compromise
the confidentiality, integrity, and availability of the affected device.
Exploitation requires access from the same local network, replay of the login
challenge data, activation of the privileged service, and a device reboot.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| TP-Link Systems Inc. | Tapo C200 v5 |
Version: 0 < V5_1.4.6 Build 260709 Rel.27675n |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102369",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T18:07:54.890490Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T18:08:05.015Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Tapo C200 v5",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V5_1.4.6 Build 260709 Rel.27675n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tapo C120 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V1_1.9.4 Build 260813 Rel.79754n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Thai Do (Lio) and Khoi Tran (KayTii) from OPSWAT"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTapo C120 v1 and C200 V5\ndo not adequately protect login challenge data or sanitize\nattacker-controlled input processed by the MacTool handler. An unauthenticated\nattacker on the same local network can replay login challenge data to obtain an\nadministrative session, enable a privileged service that becomes accessible\nafter a reboot, and submit crafted input to execute arbitrary commands within\nthe device management process.\u003c/p\u003e\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eSuccessful\nexploitation may allow arbitrary command execution on the camera and compromise\nthe confidentiality, integrity, and availability of the affected device.\nExploitation requires access from the same local network, replay of the login\nchallenge data, activation of the privileged service, and a device reboot.\u003c/p\u003e"
}
],
"value": "Tapo C120 v1 and C200 V5\ndo not adequately protect login challenge data or sanitize\nattacker-controlled input processed by the MacTool handler. An unauthenticated\nattacker on the same local network can replay login challenge data to obtain an\nadministrative session, enable a privileged service that becomes accessible\nafter a reboot, and submit crafted input to execute arbitrary commands within\nthe device management process.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow arbitrary command execution on the camera and compromise\nthe confidentiality, integrity, and availability of the affected device.\nExploitation requires access from the same local network, replay of the login\nchallenge data, activation of the privileged service, and a device reboot."
}
],
"impacts": [
{
"capecId": "CAPEC-21",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-21 Exploitation of Trusted Identifiers"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T17:42:25.482Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/tapo-c120/v1.26/#Firmware-Release-Notes"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tapo-c120/v1.26/#Firmware-Release-Notes"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5321/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 \u0026 C200",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-102369",
"datePublished": "2026-10-01T17:42:25.482Z",
"dateReserved": "2026-09-28T23:02:41.717Z",
"dateUpdated": "2026-10-01T18:08:05.015Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-102369\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-01T18:07:54.890490Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-01T18:08:00.590Z\"}}], \"cna\": {\"title\": \"Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 \u0026 C200\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Thai Do (Lio) and Khoi Tran (KayTii) from OPSWAT\"}], \"impacts\": [{\"capecId\": \"CAPEC-21\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-21 Exploitation of Trusted Identifiers\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 8.7, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"ADJACENT\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"TP-Link Systems Inc.\", \"product\": \"Tapo C200 v5\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V5_1.4.6 Build 260709 Rel.27675n\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"TP-Link Systems Inc.\", \"product\": \"Tapo C120 v1\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V1_1.9.4 Build 260813 Rel.79754n\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes\", \"tags\": [\"patch\"]}, {\"url\": \"https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes\", \"tags\": [\"patch\"]}, {\"url\": \"https://www.tp-link.com/us/support/download/tapo-c120/v1.26/#Firmware-Release-Notes\", \"tags\": [\"patch\"]}, {\"url\": \"https://www.tp-link.com/en/support/download/tapo-c120/v1.26/#Firmware-Release-Notes\", \"tags\": [\"patch\"]}, {\"url\": \"https://www.tp-link.com/us/support/faq/5321/\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.5\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Tapo C120 v1 and C200 V5\\ndo not adequately protect login challenge data or sanitize\\nattacker-controlled input processed by the MacTool handler. An unauthenticated\\nattacker on the same local network can replay login challenge data to obtain an\\nadministrative session, enable a privileged service that becomes accessible\\nafter a reboot, and submit crafted input to execute arbitrary commands within\\nthe device management process.\\n\\n\\n\\n\\n\\n\\n\\n\\n\\nSuccessful\\nexploitation may allow arbitrary command execution on the camera and compromise\\nthe confidentiality, integrity, and availability of the affected device.\\nExploitation requires access from the same local network, replay of the login\\nchallenge data, activation of the privileged service, and a device reboot.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eTapo C120 v1 and C200 V5\\ndo not adequately protect login challenge data or sanitize\\nattacker-controlled input processed by the MacTool handler. An unauthenticated\\nattacker on the same local network can replay login challenge data to obtain an\\nadministrative session, enable a privileged service that becomes accessible\\nafter a reboot, and submit crafted input to execute arbitrary commands within\\nthe device management process.\u003c/p\u003e\u003cp\u003e\\n\\n\u003c/p\u003e\u003cp\u003eSuccessful\\nexploitation may allow arbitrary command execution on the camera and compromise\\nthe confidentiality, integrity, and availability of the affected device.\\nExploitation requires access from the same local network, replay of the login\\nchallenge data, activation of the privileged service, and a device reboot.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-287\", \"description\": \"CWE-287 Improper Authentication\"}]}], \"providerMetadata\": {\"orgId\": \"f23511db-6c3e-4e32-a477-6aa17d310630\", \"shortName\": \"TPLink\", \"dateUpdated\": \"2026-10-01T17:42:25.482Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-102369\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-01T18:08:05.015Z\", \"dateReserved\": \"2026-09-28T23:02:41.717Z\", \"assignerOrgId\": \"f23511db-6c3e-4e32-a477-6aa17d310630\", \"datePublished\": \"2026-10-01T17:42:25.482Z\", \"assignerShortName\": \"TPLink\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…