CVE-2026-1871

TP-Link Tapo C200 v5 contains a stack-based buffer overflow flaw in RTSP authentication handling due to improper validation of Authorization header field lengths, which can be triggered by a crafted authentication request. Successful exploitation causes the affected RTSP core service process to crash and triggers an automatic system reboot, resulting in a denial of service (DoS) condition. This prevents legitimate users from accessing the camera’s live video stream or management interface until the service restarts.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes	Release Notes
https://www.tp-link.com/kr/support/download/tapo-c200/#Firmware-Release-Notes	Release Notes
https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes	Release Notes
https://www.tp-link.com/us/support/faq/5113/	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:tp-link:tapo_c200_firmware:1.0.5:build_240327::::::
	cpe:2.3:o:tp-link:tapo_c200_firmware:1.0.12:build_240527::::::
	cpe:2.3:o:tp-link:tapo_c200_firmware:1.0.13:build_240619::::::
	cpe:2.3:o:tp-link:tapo_c200_firmware:1.0.17:build_240806::::::
	cpe:2.3:o:tp-link:tapo_c200_firmware:1.1.4:build_241219::::::
	cpe:2.3:o:tp-link:tapo_c200_firmware:1.1.8:build_250310::::::
	cpe:2.3:o:tp-link:tapo_c200_firmware:1.2.3:build_250610::::::
	cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.1:build_250910::::::
	cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.3:build_251119::::::
	cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.5:build_260228::::::

cpe:2.3:h:tp-link:tapo_c200:5:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-02 17:16

Updated : 2026-07-22 19:10

NVD link : CVE-2026-1871

Mitre link : CVE-2026-1871

CVE.ORG link : CVE-2026-1871

JSON object : View

Products Affected

tp-link

tapo_c200
tapo_c200_firmware

CWE

CWE-121

Stack-based Buffer Overflow

{"id": "CVE-2026-1871", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1871", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T18:21:22.840412Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f23511db-6c3e-4e32-a477-6aa17d310630", "affectedData": [{"vendor": "TP-Link Systems Inc.", "product": "Tapo C200 v5", "versions": [{"status": "affected", "version": "0", "lessThan": "1.4.4 Build 260527 Rel.28339n", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-02T17:16:26.967", "references": [{"url": "https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes", "tags": ["Release Notes"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/kr/support/download/tapo-c200/#Firmware-Release-Notes", "tags": ["Release Notes"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes", "tags": ["Release Notes"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}, {"url": "https://www.tp-link.com/us/support/faq/5113/", "tags": ["Vendor Advisory"], "source": "f23511db-6c3e-4e32-a477-6aa17d310630"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "f23511db-6c3e-4e32-a477-6aa17d310630", "description": [{"lang": "en", "value": "CWE-121"}]}], "descriptions": [{"lang": "en", "value": "TP-Link Tapo C200 v5 contains a stack-based buffer overflow flaw in RTSP authentication handling due to improper validation of Authorization header field lengths, which can be triggered by a crafted authentication request.\n\nSuccessful exploitation causes the affected RTSP core service process to crash and triggers an automatic system reboot, resulting in a denial of service (DoS) condition. This prevents legitimate users from accessing the camera\u2019s live video stream or management interface until the service restarts."}, {"lang": "es", "value": "TP-Link Tapo C200 v5 contiene una falla de desbordamiento de b\u00fafer basado en pila en el manejo de la autenticaci\u00f3n RTSP debido a la validaci\u00f3n incorrecta de las longitudes de los campos del encabezado de autorizaci\u00f3n, que puede ser activada por una solicitud de autenticaci\u00f3n manipulada.\n\nLa explotaci\u00f3n exitosa provoca que el proceso del servicio central RTSP afectado se bloquee y desencadena un reinicio autom\u00e1tico del sistema, lo que resulta en una condici\u00f3n de denegaci\u00f3n de servicio (DoS). Esto impide que los usuarios leg\u00edtimos accedan a la transmisi\u00f3n de video en vivo de la c\u00e1mara o la interfaz de administraci\u00f3n hasta que el servicio se reinicie."}], "lastModified": "2026-07-22T19:10:00.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.0.5:build_240327:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05C15E7C-DAED-4332-B38E-492608EA97CD"}, {"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.0.12:build_240527:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "729217F5-CB01-4B88-BDC0-4765DF737758"}, {"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.0.13:build_240619:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "544121C2-D1BA-4FF5-9DA8-26CD67119774"}, {"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.0.17:build_240806:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "950B6D8F-158C-4DC6-BDC0-6923B0836DAF"}, {"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.1.4:build_241219:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AA70F8C-56CA-4A9E-8BFE-4B8BE5127015"}, {"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.1.8:build_250310:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "800DB4F6-511D-489F-A500-CF1575A86539"}, {"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.2.3:build_250610:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "40E223AB-51B4-4843-A82F-32145A89CFFA"}, {"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.1:build_250910:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98638E32-86B0-451C-96CA-E39C092CEB49"}, {"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.3:build_251119:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C7BC3B8D-0AAB-472A-9DC3-1FCACD246183"}, {"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.5:build_260228:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "340E2167-A8D1-4B17-904F-895574C9A3FF"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:tp-link:tapo_c200:5:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DF4B31A6-FDFD-41C5-9BEF-114B290CCBAE"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630"}