CVE-2026-78578

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-78578", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "state": "PUBLISHED", "assignerShortName": "TPLink", "dateReserved": "2026-08-24T20:46:19.845Z", "datePublished": "2026-10-01T17:42:05.535Z", "dateUpdated": "2026-10-01T18:08:30.649Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-10-01T17:42:05.535Z"}, "title": "Unauthenticated do Method Onboarding Connect Allows Wi\u2011Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-306", "description": "CWE-306 Missing authentication for critical function", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "Tapo C200 v5", "versions": [{"status": "affected", "version": "0", "lessThan": "V5_1.4.6 Build 260709 Rel.27675n", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Tapo C120 v1", "versions": [{"status": "affected", "version": "0", "lessThan": "V1_1.9.4 Build 260813 Rel.79754n", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Tapo C120 v1 and C200 v5\ndo not enforce authentication for do method HTTPS onboarding connect actions\nafter initial setup.\u00a0 An unauthenticated adjacent\nattacker can submit unauthorized wireless configuration parameters, causing the\ncamera to attempt connection to a different network.\n\n\n\n\n\nSuccessful\nexploitation disconnects the camera from its intended wireless network, making\nit unreachable on its management address, resulting in a denial-of-service\ncondition.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Tapo C120 v1 and C200 v5\ndo not enforce authentication for do method HTTPS onboarding connect actions\nafter initial setup.&nbsp; An unauthenticated adjacent\nattacker can submit unauthorized wireless configuration parameters, causing the\ncamera to attempt connection to a different network.</p>\n\n<p>Successful\nexploitation disconnects the camera from its intended wireless network, making\nit unreachable on its management address, resulting in a denial-of-service\ncondition.</p>"}]}], "references": [{"url": "https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/download/tapo-c120/v1.26/#Firmware-Release-Notes", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/tapo-c120/v1.26/#Firmware-Release-Notes", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/faq/5321/", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "Thai Do (Lio) and Khoi Tran (KayTii) from OPSWAT", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-01T18:08:21.543786Z", "id": "CVE-2026-78578", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-01T18:08:30.649Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-78578", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-01T18:08:21.543786Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-01T18:08:24.457Z"}}], "cna": {"title": "Unauthenticated do Method Onboarding Connect Allows Wi\u2011Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Thai Do (Lio) and Khoi Tran (KayTii) from OPSWAT"}], "impacts": [{"capecId": "CAPEC-1", "descriptions": [{"lang": "en", "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TP-Link Systems Inc.", "product": "Tapo C200 v5", "versions": [{"status": "affected", "version": "0", "lessThan": "V5_1.4.6 Build 260709 Rel.27675n", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "TP-Link Systems Inc.", "product": "Tapo C120 v1", "versions": [{"status": "affected", "version": "0", "lessThan": "V1_1.9.4 Build 260813 Rel.79754n", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/download/tapo-c120/v1.26/#Firmware-Release-Notes", "tags": ["patch"]}, {"url": "https://www.tp-link.com/en/support/download/tapo-c120/v1.26/#Firmware-Release-Notes", "tags": ["patch"]}, {"url": "https://www.tp-link.com/us/support/faq/5321/", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "Tapo C120 v1 and C200 v5\ndo not enforce authentication for do method HTTPS onboarding connect actions\nafter initial setup.\u00a0 An unauthenticated adjacent\nattacker can submit unauthorized wireless configuration parameters, causing the\ncamera to attempt connection to a different network.\n\n\n\n\n\nSuccessful\nexploitation disconnects the camera from its intended wireless network, making\nit unreachable on its management address, resulting in a denial-of-service\ncondition.", "supportingMedia": [{"type": "text/html", "value": "<p>Tapo C120 v1 and C200 v5\ndo not enforce authentication for do method HTTPS onboarding connect actions\nafter initial setup.&nbsp; An unauthenticated adjacent\nattacker can submit unauthorized wireless configuration parameters, causing the\ncamera to attempt connection to a different network.</p>\n\n<p>Successful\nexploitation disconnects the camera from its intended wireless network, making\nit unreachable on its management address, resulting in a denial-of-service\ncondition.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing authentication for critical function"}]}], "providerMetadata": {"orgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "shortName": "TPLink", "dateUpdated": "2026-10-01T17:42:05.535Z"}}}, "cveMetadata": {"cveId": "CVE-2026-78578", "state": "PUBLISHED", "dateUpdated": "2026-10-01T18:08:30.649Z", "dateReserved": "2026-08-24T20:46:19.845Z", "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630", "datePublished": "2026-10-01T17:42:05.535Z", "assignerShortName": "TPLink"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Tapo C200 v5", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "V5_1.4.6 Build 260709 Rel.27675n", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Tapo C120 v1", "vendor": "TP-Link Systems Inc.", "versions": [{"lessThan": "V1_1.9.4 Build 260813 Rel.79754n", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Tapo C120 v1 and C200 v5\ndo not enforce authentication for do method HTTPS onboarding connect actions\nafter initial setup.\u00a0 An unauthenticated adjacent\nattacker can submit unauthorized wireless configuration parameters, causing the\ncamera to attempt connection to a different network.\n\n\n\n\n\nSuccessful\nexploitation disconnects the camera from its intended wireless network, making\nit unreachable on its management address, resulting in a denial-of-service\ncondition."}], "id": "CVE-2026-78578", "lastModified": "2026-10-01T20:36:38.330", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78578", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-01T18:08:21.543786Z", "version": "2.0.3"}}]}, "published": "2026-10-01T18:17:27.997", "references": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/en/support/download/tapo-c120/v1.26/#Firmware-Release-Notes"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/us/support/download/tapo-c120/v1.26/#Firmware-Release-Notes"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes"}, {"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "url": "https://www.tp-link.com/us/support/faq/5321/"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,V1_1.9.4 Build 260813 Rel.79754n)"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 83.0, "source": "matching"}]}, "original": {"product": "Tapo C120 v1", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "tapo_c120_v1", "vendor": "tp-link"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,V5_1.4.6 Build 260709 Rel.27675n)"}}], "enrichment": {"confidence": 83.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 83.0, "source": "matching"}]}, "original": {"product": "Tapo C200 v5", "source": "cna", "vendor": "TP-Link Systems Inc."}, "product": "tapo_c200_v5", "vendor": "tp-link"}], "created": "2026-10-01T19:30:11.918597+00:00", "updated": "2026-10-02T14:30:23.056391+00:00", "vendors": ["tp-link", "tp-link$PRODUCT$tapo_c120_v1", "tp-link$PRODUCT$tapo_c200_v5"]}