Vulnerability · Published Mar 7, 2022 · Assigned by INCIBE
CVE-2021-4045TP-LINK Tapo C200 remote code execution vulnerability
Critical 9.8
In plain English
A critical-severity command injection in Tapo C200 from TP-Link. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 72.4% (higher than 99.4% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)72.4%top 0.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root. The exploitation of this vulnerability allows an attacker to take full control of the camera.
Affected products (as reported)
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H