CVE-2026-12760

A denial-of-service (DoS) vulnerability has been identified in Tapo C200 v3 in the network packet handling logic due to improper handling of IPv4 fragmented packets. An unauthenticated adjacent attacker can send crafted packets to cause excessive resource consumption, leading to instability of the device.Successful exploitation can remotely trigger a temporary denial-of-service condition, causing the camera to become unresponsive and resulting in intermittent loss of video monitoring and recording.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.tp-link.com/en/support/download/tapo-c200/v3/#Firmware-Release-Notes	Release Notes
https://www.tp-link.com/us/support/download/tapo-c200/v3/#Firmware-Release-Notes	Release Notes
https://www.tp-link.com/us/support/faq/5143/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.3:build_230228::::::
	cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.4:build_230424::::::
	cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.5:build_230717::::::
	cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.7:build_230920::::::
	cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.9:build_231019::::::
	cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.11:build_231115::::::
	cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.13:build_240327::::::
	cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.14:build_240513::::::
	cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.15:build_240715::::::
	cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.1:build_241212::::::
	cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.2:build_250313::::::

cpe:2.3:h:tp-link:tapo_c200:3:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-24 19:17

Updated : 2026-06-29 16:17

NVD link : CVE-2026-12760

Mitre link : CVE-2026-12760

CVE.ORG link : CVE-2026-12760

JSON object : View

Products Affected

tp-link

tapo_c200
tapo_c200_firmware

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-12760", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12760", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-24T18:53:30.462879Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "affectedData": [{"vendor": "TP-Link Systems Inc.", "product": "Tapo C200 v3", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.4 Build 250922", "versionType": "custom"}], "platforms": ["NVMP"], "defaultStatus": "unaffected"}]}], "published": "2026-06-24T19:17:08.237", "references": [{"url": "https://www.tp-link.com/en/support/download/tapo-c200/v3/#Firmware-Release-Notes", "tags": ["Release Notes"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/download/tapo-c200/v3/#Firmware-Release-Notes", "tags": ["Release Notes"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/faq/5143/", "tags": ["Vendor Advisory"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "A denial-of-service (DoS) vulnerability has been identified in Tapo C200 v3 in the network packet handling logic due to improper handling of IPv4 fragmented packets.\u00a0 An unauthenticated adjacent attacker can send crafted packets to cause excessive resource consumption, leading to instability of the device.Successful exploitation can remotely trigger a temporary denial-of-service condition,\u00a0causing the camera to become unresponsive and resulting in intermittent loss of video monitoring and recording."}], "lastModified": "2026-06-29T16:17:25.343", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.3:build_230228:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CABD8DE6-9904-499D-919F-9DBD42BE6762"}, {"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.4:build_230424:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "254031B5-7CC7-4B9D-970B-FAA6EBC3EAFD"}, {"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.5:build_230717:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D61B481-8262-44D4-9A1D-9967AB1805DC"}, {"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.7:build_230920:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "50D2F368-F8C8-41E1-9360-8CDF9F89E566"}, {"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.9:build_231019:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EF80958C-4274-4DEA-9730-176E3E6F21F2"}, {"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.11:build_231115:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7AA1B7FA-D418-46B2-A530-BF67E550E38F"}, {"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.13:build_240327:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DC4382B5-C7EC-4B98-AF28-8D08D0771133"}, {"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.14:build_240513:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1FCE1F5E-E84B-4CF4-B8A4-7A3448A0D127"}, {"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.15:build_240715:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C05AC5C2-5BB7-499A-AE2B-414103317D47"}, {"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.1:build_241212:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1ED28D6-9441-440A-81D8-EB539D50BB56"}, {"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.2:build_250313:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51E28752-8B46-48CD-86B5-437449AED7C0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tapo_c200:3:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "101FA54E-1A3D-4A38-BBD0-8DAFAC414EA3"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630"}