CVE-2026-78577 (GCVE-0-2026-78577)
Vulnerability from cvelistv5
Published
2026-10-01 17:41
Modified
2026-10-01 18:08
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-306 - Missing authentication for critical function
Summary
Tapo C120 v1 and C200 V5
contain a vulnerability in the HTTPS onboarding scan function due to missing authentication.
After initial setup, an unauthenticated attacker on the same local network can
invoke the scan action and retrieve nearby wireless access-point metadata,
including SSIDs, BSSIDs, authentication and encryption modes, and
signal-strength information.
Successful
exploitation may disclose information about the wireless environment
surrounding the camera, allowing an attacker to learn elements of the local
wireless topology.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| TP-Link Systems Inc. | Tapo C200 v5 |
Version: 0 < V5_1.4.6 Build 260709 Rel.27675n |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78577",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T18:08:50.711151Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T18:08:59.956Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Tapo C200 v5",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V5_1.4.6 Build 260709 Rel.27675n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tapo C120 v1",
"vendor": "TP-Link Systems Inc.",
"versions": [
{
"lessThan": "V1_1.9.4 Build 260813 Rel.79754n",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Thai Do (Lio) and Khoi Tran (KayTii) from OPSWAT"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTapo C120 v1 and C200 V5\ncontain a vulnerability in the HTTPS onboarding scan function due to missing authentication.\nAfter initial setup, an unauthenticated attacker on the same local network can\ninvoke the scan action and retrieve nearby wireless access-point metadata,\nincluding SSIDs, BSSIDs, authentication and encryption modes, and\nsignal-strength information.\u003c/p\u003e\u003cp\u003e\n\n\u003c/p\u003e\u003cp\u003eSuccessful\nexploitation may disclose information about the wireless environment\nsurrounding the camera, allowing an attacker to learn elements of the local\nwireless topology.\u0026nbsp;\u003cb\u003e\u003c/b\u003e\u003c/p\u003e"
}
],
"value": "Tapo C120 v1 and C200 V5\ncontain a vulnerability in the HTTPS onboarding scan function due to missing authentication.\nAfter initial setup, an unauthenticated attacker on the same local network can\ninvoke the scan action and retrieve nearby wireless access-point metadata,\nincluding SSIDs, BSSIDs, authentication and encryption modes, and\nsignal-strength information.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may disclose information about the wireless environment\nsurrounding the camera, allowing an attacker to learn elements of the local\nwireless topology."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing authentication for critical function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T17:41:49.774Z",
"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"shortName": "TPLink"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/us/support/download/tapo-c120/v1.26/#Firmware-Release-Notes"
},
{
"tags": [
"patch"
],
"url": "https://www.tp-link.com/en/support/download/tapo-c120/v1.26/#Firmware-Release-Notes"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://www.tp-link.com/us/support/faq/5321/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 \u0026 C200",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
"assignerShortName": "TPLink",
"cveId": "CVE-2026-78577",
"datePublished": "2026-10-01T17:41:49.774Z",
"dateReserved": "2026-08-24T20:46:18.534Z",
"dateUpdated": "2026-10-01T18:08:59.956Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-78577\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-01T18:08:50.711151Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-01T18:08:54.790Z\"}}], \"cna\": {\"title\": \"Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 \u0026 C200\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Thai Do (Lio) and Khoi Tran (KayTii) from OPSWAT\"}], \"impacts\": [{\"capecId\": \"CAPEC-1\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 5.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"ADJACENT\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"TP-Link Systems Inc.\", \"product\": \"Tapo C200 v5\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V5_1.4.6 Build 260709 Rel.27675n\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"TP-Link Systems Inc.\", \"product\": \"Tapo C120 v1\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V1_1.9.4 Build 260813 Rel.79754n\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes\", \"tags\": [\"patch\"]}, {\"url\": \"https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes\", \"tags\": [\"patch\"]}, {\"url\": \"https://www.tp-link.com/us/support/download/tapo-c120/v1.26/#Firmware-Release-Notes\", \"tags\": [\"patch\"]}, {\"url\": \"https://www.tp-link.com/en/support/download/tapo-c120/v1.26/#Firmware-Release-Notes\", \"tags\": [\"patch\"]}, {\"url\": \"https://www.tp-link.com/us/support/faq/5321/\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.5\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Tapo C120 v1 and C200 V5\\ncontain a vulnerability in the HTTPS onboarding scan function due to missing authentication.\\nAfter initial setup, an unauthenticated attacker on the same local network can\\ninvoke the scan action and retrieve nearby wireless access-point metadata,\\nincluding SSIDs, BSSIDs, authentication and encryption modes, and\\nsignal-strength information.\\n\\n\\n\\n\\n\\n\\n\\n\\n\\nSuccessful\\nexploitation may disclose information about the wireless environment\\nsurrounding the camera, allowing an attacker to learn elements of the local\\nwireless topology.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eTapo C120 v1 and C200 V5\\ncontain a vulnerability in the HTTPS onboarding scan function due to missing authentication.\\nAfter initial setup, an unauthenticated attacker on the same local network can\\ninvoke the scan action and retrieve nearby wireless access-point metadata,\\nincluding SSIDs, BSSIDs, authentication and encryption modes, and\\nsignal-strength information.\u003c/p\u003e\u003cp\u003e\\n\\n\u003c/p\u003e\u003cp\u003eSuccessful\\nexploitation may disclose information about the wireless environment\\nsurrounding the camera, allowing an attacker to learn elements of the local\\nwireless topology.\u0026nbsp;\u003cb\u003e\u003c/b\u003e\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-306\", \"description\": \"CWE-306 Missing authentication for critical function\"}]}], \"providerMetadata\": {\"orgId\": \"f23511db-6c3e-4e32-a477-6aa17d310630\", \"shortName\": \"TPLink\", \"dateUpdated\": \"2026-10-01T17:41:49.774Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-78577\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-01T18:08:59.956Z\", \"dateReserved\": \"2026-08-24T20:46:18.534Z\", \"assignerOrgId\": \"f23511db-6c3e-4e32-a477-6aa17d310630\", \"datePublished\": \"2026-10-01T17:41:49.774Z\", \"assignerShortName\": \"TPLink\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…