What’s Vulnerable › Products

TP-Link Systems Inc. Tapo C200 v5 vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 11 published in the last 12 months.

Check whether your TP-Link Systems Inc. Tapo C200 v5 version is affected

Latest TP-Link Systems Inc. Tapo C200 v5 vulnerabilities

• CVE-2026-9032 — Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerability in TP-Link Tapo C120 & C200 (CVSS 7.1)
• CVE-2026-78578 — Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200 (CVSS 7.1)
• CVE-2026-78577 — Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200 (CVSS 5.3)
• CVE-2026-102369 — Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200 (CVSS 8.7)
• CVE-2026-15316 — Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200 (CVSS 6.5)
• CVE-2026-15315 — Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200 (CVSS 8.8)
• CVE-2026-12760 — Denial-of-Service Vulnerability via Malformed IPv4 Fragmentation Handling in TP-Link Tapo C200 (CVSS 6.5)
• CVE-2026-1871 — Authenticated Stack-based Buffer Overflow in RTSP Authentication of Tapo C200 (CVSS 6.5)
• CVE-2025-8065 — Remote Code Execution via Stack-based Buffer Overflow in ONVIF SOAP Parser in TP-Link Tapo C200 and C520WS (CVSS 6.5)
• CVE-2025-14300 — Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425 (CVSS 8.1)
• CVE-2025-14299 — Improper Content-Length Validation in HTTPS Requests on Tapo C200 (CVSS 6.5)
• CVE-2023-49515 — (CVSS 4.6)
• CVE-2023-27126 — (CVSS 4.6)
• CVE-2021-4045 — TP-LINK Tapo C200 remote code execution vulnerability (CVSS 9.8)
• CVE-2020-11445 — (CVSS 5.3)