{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15316",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T13:31:45.040163Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T15:36:48.337Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Tapo C200 v5",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "V5_1.4.6 Build 260709 Rel.27675n",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thai Do (Lio) and Khoi Tran (KayTii) from OPSWAT"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan\u003eAn improper input\nvalidation vulnerability in the configuration service for processing encrypted\ncredential data has been identified in Tapo C200 v5.\u003c/span\u003e\u003cspan\u003e\u0026nbsp; \u003c/span\u003e\u003cspan\u003eAn attacker can send oversized crypted\nciphertext values that may trigger exception handling failures, due to insufficient\nvalidation, causing the affected device to crash or restart.\u003c/span\u003e\u003c/p\u003e\n\n\u003cp\u003eSuccessful\nexploitation may temporarily disrupt HTTPS management and monitoring\nfunctionality, resulting in a denial-of-service (DoS) condition until the\nservice recovers.\u003c/p\u003e"
            }
          ],
          "value": "An improper input\nvalidation vulnerability in the configuration service for processing encrypted\ncredential data has been identified in Tapo C200 v5.\u00a0 An attacker can send oversized crypted\nciphertext values that may trigger exception handling failures, due to insufficient\nvalidation, causing the affected device to crash or restart.\n\n\n\n\n\nSuccessful\nexploitation may temporarily disrupt HTTPS management and monitoring\nfunctionality, resulting in a denial-of-service (DoS) condition until the\nservice recovers."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-24",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-24 Filter Failure through Buffer Overflow"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20 Improper input validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T21:25:11.118Z",
        "orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "shortName": "TPLink"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/us/support/download/tapo-c200/v5/"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/en/support/download/tapo-c200/v5/"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.tp-link.com/us/support/faq/5248/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
    "assignerShortName": "TPLink",
    "cveId": "CVE-2026-15316",
    "datePublished": "2026-08-18T21:25:11.118Z",
    "dateReserved": "2026-07-09T17:55:11.713Z",
    "dateUpdated": "2026-08-20T15:36:48.337Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}