CVE-2026-15316: fallo de gravedad alta en TP-Link Systems Inc. Tapo C200 v5
Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 0.3%
An improper input
validation vulnerability in the configuration service for processing encrypted
credential data has been identified in Tapo C200 v5. An attacker can send oversized crypted
ciphertext values that may trigger exception handling failures, due to insufficient
validation, causing the affected device to crash or restart.
Successful
exploitation may temporarily disrupt HTTPS management and monitoring
functionality, resulting in a denial-of-service (DoS) condition until the
service recovers.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Productos afectados
TP-Link Systems Inc. · Tapo C200 v5CVEs relacionadas — TP-Link Systems Inc. Tapo C200 v5
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-15315HIGHUnauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200EPSS 0.5%CVE-2026-1871HIGHAuthenticated Stack-based Buffer Overflow in RTSP Authentication of Tapo C200EPSS 0.3%CVE-2026-78578HIGHUnauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200EPSS 0.3%CVE-2026-102369HIGHUnauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200EPSS 0.3%CVE-2026-78577MEDIUMUnauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200EPSS 0.2%