CVE-2026-1871: falha de alta gravidade em TP-Link Systems Inc. Tapo C200 v5
Authenticated Stack-based Buffer Overflow in RTSP Authentication of Tapo C200
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.3%
TP-Link Tapo C200 v5 contains a stack-based buffer overflow flaw in RTSP authentication handling due to improper validation of Authorization header field lengths, which can be triggered by a crafted authentication request.
Successful exploitation causes the affected RTSP core service process to crash and triggers an automatic system reboot, resulting in a denial of service (DoS) condition. This prevents legitimate users from accessing the camera’s live video stream or management interface until the service restarts.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
TP-Link Systems Inc. · Tapo C200 v5CVEs relacionadas — TP-Link Systems Inc. Tapo C200 v5
No mesmo produto, das mais perigosas para as menos.
CVE-2026-15315HIGHUnauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200EPSS 0.5%CVE-2026-15316HIGHDenial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200EPSS 0.3%CVE-2026-78578HIGHUnauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200EPSS 0.3%CVE-2026-102369HIGHUnauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200EPSS 0.3%CVE-2026-78577MEDIUMUnauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200EPSS 0.2%