CVE-2026-12760

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-12760
A denial-of-service (DoS) vulnerability has been identified in Tapo C200 v3 in the network packet handling logic due to improper handling of IPv4 fragmented packets.  An unauthenticated adjacent attacker can send crafted packets to cause excessive resource consumption, leading to instability of the device.Successful exploitation can remotely trigger a temporary denial-of-service condition, causing the camera to become unresponsive and resulting in intermittent loss of video monitoring and recording.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://www.tp-link.com/en/support/download/tapo-c200/v3/#Firmware-Release-Notes Release Notes
https://www.tp-link.com/us/support/download/tapo-c200/v3/#Firmware-Release-Notes Release Notes
https://www.tp-link.com/us/support/faq/5143/ Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.3:build_230228:*:*:*:*:*:*
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.4:build_230424:*:*:*:*:*:*
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.5:build_230717:*:*:*:*:*:*
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.7:build_230920:*:*:*:*:*:*
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.9:build_231019:*:*:*:*:*:*
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.11:build_231115:*:*:*:*:*:*
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.13:build_240327:*:*:*:*:*:*
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.14:build_240513:*:*:*:*:*:*
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.15:build_240715:*:*:*:*:*:*
cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.1:build_241212:*:*:*:*:*:*
cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.2:build_250313:*:*:*:*:*:*
cpe:2.3:h:tp-link:tapo_c200:3:*:*:*:*:*:*:*
History

25 Oct 2026, 22:10

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de denegación de servicio (DoS) ha sido identificada en Tapo C200 v3 en la lógica de manejo de paquetes de red debido a un manejo inadecuado de paquetes IPv4 fragmentados. Un atacante adyacente no autenticado puede enviar paquetes manipulados para causar un consumo excesivo de recursos, lo que lleva a la inestabilidad del dispositivo. La explotación exitosa puede desencadenar remotamente una condición temporal de denegación de servicio, haciendo que la cámara deje de responder y resultando en una pérdida intermitente de monitoreo y grabación de video.
Information

Published : 2026-06-24 19:17

Updated : 2026-10-25 22:10

NVD link : CVE-2026-12760

Mitre link : CVE-2026-12760

CVE.ORG link : CVE-2026-12760

JSON object : View

Products Affected

tp-link

  • tapo_c200_firmware
  • tapo_c200
CWE
CWE-770

Allocation of Resources Without Limits or Throttling