---
id: CVE-2026-102369
title: |-
  Tapo C120 v1 and C200 V5
  do not adequately protect login challenge data or sanitize
  attacker-controlled input processed by the MacTool handler
summary: |-
  Tapo C120 v1 and C200 V5
  do not adequately protect login challenge data or sanitize
  attacker-controlled input processed by the MacTool handler. An unauthenticated
  attacker on the same local network can replay login challenge data to obta…
severity: high
cvss: 8.7
cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cwe:
  - CWE-287
vendor: TP-Link Systems Inc.
product: Tapo C200 v5
affected:
  - tapo_c200_v5 < V5_1.4.6 Build 260709 Rel.27675n
  - tapo_c120_v1 < V1_1.9.4 Build 260813 Rel.79754n
published: '2026-10-01'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T20:36:38.330'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102369'
references:
  - url: >-
      https://www.tp-link.com/en/support/download/tapo-c120/v1.26/#Firmware-Release-Notes
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: >-
      https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: >-
      https://www.tp-link.com/us/support/download/tapo-c120/v1.26/#Firmware-Release-Notes
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: >-
      https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes
    label: f23511db-6c3e-4e32-a477-6aa17d310630
  - url: 'https://www.tp-link.com/us/support/faq/5321/'
    label: f23511db-6c3e-4e32-a477-6aa17d310630
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-01T18:07:54.890490Z'
cvssSource: cna
ingestedAt: '2026-10-01T18:55:42.367Z'
epss: 0.00268
epssPercentile: 0.18811
---

## Overview

Tapo C120 v1 and C200 V5
do not adequately protect login challenge data or sanitize
attacker-controlled input processed by the MacTool handler. An unauthenticated
attacker on the same local network can replay login challenge data to obtain an
administrative session, enable a privileged service that becomes accessible
after a reboot, and submit crafted input to execute arbitrary commands within
the device management process.









Successful
exploitation may allow arbitrary command execution on the camera and compromise
the confidentiality, integrity, and availability of the affected device.
Exploitation requires access from the same local network, replay of the login
challenge data, activation of the privileged service, and a device reboot.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.