TP-Link Tapo C120/C200: Command injection in MacTool handler
Summary
Tapo C120 v1 and Tapo C200 v5 cameras do not adequately protect login challenge data or sanitize input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service, and submit crafted input to execute arbitrary commands in the device management process after a reboot. Successful exploitation can compromise the confidentiality, integrity and availability of the camera (CVSS 4.0 base score 8.7, high).
Affected
- Tapo C200 v5: versions before V5_1.4.6 Build 260709 Rel.27675n
- Tapo C120 v1: versions before V1_1.9.4 Build 260813 Rel.79754n
Fixed in
- Tapo C200 v5: V5_1.4.6 Build 260709 Rel.27675n or later
- Tapo C120 v1: V1_1.9.4 Build 260813 Rel.79754n or later (not yet confirmed by the vendor)
- Release dates in the sources conflict; exact fix date unknown.
Workaround
Unknown. No vendor workaround was found. Restrict network access to the cameras as a risk-reduction measure.
Exploitation
- CISA SSVC: exploitation none, automatable no; not listed in CISA KEV.
- No known active exploitation and no confirmed public proof of concept reported in a secondary source.
- OPSWAT describes the flaw as a step in a chain with CVE-2026-15315, an authentication bypass; exploitation details were omitted.
Our recommendation
- Update the Tapo C200 v5 to V5_1.4.6 Build 260709 or later and the Tapo C120 v1 to V1_1.9.4 Build 260813 or later; verify the C120 build against TP-Link's release notes.
- Place cameras on a separate IoT VLAN without access to client networks and block management access from general hosts.
- Check which cameras are on flat networks, guest Wi-Fi or other LANs that intruders or infected devices can reach.
- Monitor camera network traffic and logs for unexpected reboots, new services or sessions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- TP-Link Tapo C200 v5 firmware release notes (EN) www.tp-link.com
- TP-Link Tapo C120 v1 firmware release notes (EN) www.tp-link.com
- TP-Link FAQ 5321 www.tp-link.com
- OPSWAT: From authentication bypass to full camera compromise www.opswat.com
- OpenCVE: CVE-2026-102369 app.opencve.io
- DEV Community analysis of CVE-2026-102369 dev.to
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:18.
Original description (NVD)
Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service that becomes accessible after a reboot, and submit crafted input to execute arbitrary commands within the device management process. Successful exploitation may allow arbitrary command execution on the camera and compromise the confidentiality, integrity, and availability of the affected device. Exploitation requires access from the same local network, replay of the login challenge data, activation of the privileged service, and a device reboot.
NVD references (5)
- https://www.tp-link.com/en/support/download/tapo-c120/v1.26/#Firmware-Release-Notes
- https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/download/tapo-c120/v1.26/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/faq/5321/
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.