Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200
Summary
| CVE | CVE-2026-15315 |
|---|---|
| State | PUBLISHED |
| Assigner | TPLink |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-08-18 22:16:49 UTC |
| Updated | 2026-09-04 17:39:06 UTC |
| Description | Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module. An attacker on the local network can exploit weaknesses in challenge parameter validation to bypass normal authentication controls and obtain administrative session tokens. Successful exploitation may allow an attacker to subsequently execute privileged management actions, enable unauthorized administrative access and temporary disruption of device services, resulting in a denial-of-service (DoS) condition. |
Risk And Classification
Primary CVSS: v4.0 8.7 HIGH from f23511db-6c3e-4e32-a477-6aa17d310630
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.002960000 probability, percentile 0.219120000 (date 2026-09-07)
Problem Types: CWE-287 | CWE-287 CWE-287 Improper Authentication
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | f23511db-6c3e-4e32-a477-6aa17d310630 | Secondary | 8.7 | HIGH | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.7 | HIGH | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Primary | 8.8 | HIGH | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVSS v4.0 Breakdown
Attack Vector
AdjacentAttack Complexity
LowAttack Requirements
NonePrivileges Required
NoneUser Interaction
NoneConfidentiality
HighIntegrity
HighAvailability
HighSub Conf.
NoneSub Integrity
NoneSub Availability
NoneCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
Attack Vector
AdjacentAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Hardware | Tp-link | Tapo C120 | - | All | All | All |
| Operating System | Tp-link | Tapo C120 Firmware | All | All | All | All |
| Hardware | Tp-link | Tapo C200 | 5.0 | All | All | All |
| Operating System | Tp-link | Tapo C200 Firmware | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | TP-Link Systems Inc. | Tapo C200 V5 | affected V5_1.4.6 Build 260709 Rel.27675n custom | Not specified |
| CNA | TP-Link Systems Inc | Tapo C120 V1 | affected 1.9.3 Build 260521 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.tp-link.com/us/support/faq/5248 | f23511db-6c3e-4e32-a477-6aa17d310630 | www.tp-link.com | Vendor Advisory, Patch |
| www.tp-link.com/us/support/download/tapo-c200/v5 | f23511db-6c3e-4e32-a477-6aa17d310630 | www.tp-link.com | Product, Release Notes |
| www.tp-link.com/us/support/download/tapo-c120/v1.26 | f23511db-6c3e-4e32-a477-6aa17d310630 | www.tp-link.com | Release Notes, Product |
| www.tp-link.com/en/support/download/tapo-c200/v5 | f23511db-6c3e-4e32-a477-6aa17d310630 | www.tp-link.com | Product, Release Notes |
| www.tp-link.com/en/support/download/tapo-c120/v1.26 | f23511db-6c3e-4e32-a477-6aa17d310630 | www.tp-link.com | Release Notes, Product |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Thai Do (Lio) and Khoi Tran (KayTii) from OPSWAT (en)
CNA: Max Aitel (en)
There are currently no legacy QID mappings associated with this CVE.