Missing authentication in TP-Link Tapo cameras enables local Wi-Fi reconfiguration and denial of service

The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS).

• Tapo C200 v3: affected below V3_1.4.5 Build 251104. The TP-Link advisory lists this branch for the vulnerability.
• Tapo C200 v5: the supplied affected facts identify versions below V5_1.4.6 Build 260709 as affected. The current TP-Link advisory reviewed here lists Tapo C200 v3, not v5, for this CVE. This is a documentation discrepancy that should be checked against the applicable regional firmware release.
• Tapo C100 v5: affected below V5_1.4.4 Build 260303.
• Tapo C425 v1.2: affected below V1.20_1.2.27 Build 260518.

Each affected product entry has a default status of unaffected outside its stated boundary. No additional Tapo branch is confirmed by this record for this vulnerability.

TP-Link Systems Inc. exposes a connectAP interface through the cameras' HTTPS service without proper authentication. An attacker must be on the same local network segment as the device and can send requests to the interface to change its Wi-Fi configuration. The weakness is CWE-306, missing authentication for a critical function. The confirmed result of that configuration change is loss of connectivity and denial of service. The exact request format, the missing authentication check, and whether the interface exposes additional operations are not documented. The supported hardware and firmware scope is listed in affected_summary.

The vulnerability is reachable over the network from a host on the same local network segment as the camera. No authentication or user interaction is required, and the supplied record describes low attack complexity. The supplied record does not mark the issue as known exploited and marks public exploit as false. It provides no exploit code, campaign, victim, or observed-abuse details. This is a statement about the record's status and does not prove that exploitation cannot occur.

The confirmed technical outcome is modification of the camera's Wi-Fi configuration, followed by loss of connectivity and denial of service. The attacker needs no prior privileges but must have access to the same local network segment; the supplied vector marks the impact scope as unchanged. The configuration change affects device integrity and can interrupt camera availability. The record does not establish privilege escalation, code execution, access to video data, or direct impact on neighboring systems. Other operations that may be available through connectAP remain unknown.

• A camera can be forced to change its Wi-Fi configuration and lose connectivity to the operating network.
• The resulting disconnection may interrupt camera-dependent monitoring, remote access, or operational workflows; the actual service disruption depends on the deployment.
• An unauthorized network-setting change creates an integrity impact to the device configuration and may require operational recovery work.
• The available evidence does not establish video-data disclosure, compromise of other network systems, or a specific breach.

1. Update Tapo C100 v5 to the vendor-listed firmware V5_1.4.4 Build 260303.
2. Update Tapo C425 v1.2 to the vendor-listed firmware V1.20_1.2.27 Build 260518.
3. Update Tapo C200 v3 to the vendor-listed firmware V3_1.4.5 Build 251104.
4. For Tapo C200 v5, the supplied affected data identifies V5_1.4.6 Build 260709 as the remediation boundary. Use the official regional firmware for that branch and confirm applicability because the current TP-Link advisory does not list Tapo C200 v5 for this vulnerability.
5. Use Tapo Mobile Application or the TP-Link firmware download pages to check and update the correct model, hardware revision, and firmware branch.
6. The supplied record and reviewed advisory provide no specific workaround. Devices that are not updated or mitigated as directed by TP-Link may remain vulnerable.

1. Inventory Tapo cameras by model, hardware revision, and installed firmware.
2. Compare each device with the version boundaries in affected_summary rather than checking only the product family name.
3. Use Tapo Mobile Application or the TP-Link firmware portal to verify that the firmware matches the correct model and hardware revision and that the update completed.
4. As a precautionary monitoring measure, review local network telemetry for unexpected HTTPS requests to connectAP and unexpected Wi-Fi configuration changes. These are investigative signals, not vendor-confirmed indicators of compromise.
5. Do not treat the absence of such logs or requests as proof that a device is safe.