CVE-2026-15315: Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-18 · updated 2026-09-04
Weakness: CWE-287

Description

Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module. An attacker on the local network can exploit weaknesses in challenge parameter validation to bypass normal authentication controls and obtain administrative session tokens. Successful exploitation may allow an attacker to subsequently execute privileged management actions, enable unauthorized administrative access and temporary disruption of device services, resulting in a denial-of-service (DoS) condition.

Affected products

TP-Link Tapo C120 Firmware: before 1.9.3 — fixed in 1.9.3
TP-Link Systems Inc. Tapo C200 v5: before 1.4.6 — fixed in 1.4.6

How to fix

Upgrade to a fixed version: TP-Link Tapo C120 Firmware 1.9.3; TP-Link Systems Inc. Tapo C200 v5 1.4.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-15315 or the next vulnerability affects your stack