Vulnerability · Published Oct 1, 2026 · Assigned by TPLink

CVE-2026-102369Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200

High 8.7

In plain English

A high-severity improper authentication in Tapo C120 v1 from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.3%top 81.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service that becomes accessible after a reboot, and submit crafted input to execute arbitrary commands within the device management process. Successful exploitation may allow arbitrary command execution on the camera and compromise the confidentiality, integrity, and availability of the affected device. Exploitation requires access from the same local network, replay of the login challenge data, activation of the privileged service, and a device reboot.

Affected products (as reported)

Vendor	Product	Versions
TP-Link Systems Inc.	Tapo C200 v5	0 – before V5_1.4.6 Build 260709 Rel.27675n
TP-Link Systems Inc.	Tapo C120 v1	0 – before V1_1.9.4 Build 260813 Rel.79754n

Weakness: CWE-287 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

In plain English

Official description

Affected products (as reported)

References