CVE-2026-15316: high-severity vulnerability in TP-Link Systems Inc. Tapo C200 v5
Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.3%
An improper input
validation vulnerability in the configuration service for processing encrypted
credential data has been identified in Tapo C200 v5. An attacker can send oversized crypted
ciphertext values that may trigger exception handling failures, due to insufficient
validation, causing the affected device to crash or restart.
Successful
exploitation may temporarily disrupt HTTPS management and monitoring
functionality, resulting in a denial-of-service (DoS) condition until the
service recovers.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
TP-Link Systems Inc. · Tapo C200 v5Related CVEs — TP-Link Systems Inc. Tapo C200 v5
In the same product, most dangerous first.
CVE-2026-15315HIGHUnauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200EPSS 0.5%CVE-2026-1871HIGHAuthenticated Stack-based Buffer Overflow in RTSP Authentication of Tapo C200EPSS 0.3%CVE-2026-78578HIGHUnauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200EPSS 0.3%CVE-2026-102369HIGHUnauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200EPSS 0.3%CVE-2026-78577MEDIUMUnauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200EPSS 0.2%