CVE-2026-15315Patch(tp-link / tapo_c120)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch tp-link tapo_c120 systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module. An attacker on the local network can exploit weaknesses in challenge parameter validation to bypass normal authentication controls and obtain administrative session tokens. Successful exploitation may allow an attacker to subsequently execute privileged management actions, enable unauthorized administrative access and temporary disruption of device services, resulting in a denial-of-service (DoS) condition.

tp-link CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Patch / fix

https://www.tp-link.com/us/support/faq/5248/

Other references

Weakness type (CWE)

CWE-287

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

tapo_c120
tapo_c120_firmware
tapo_c200
tapo_c200_firmware

Threat summary

Patch or workaround signal is available
9 mentions across 7 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 5 signals
Technical details provided in 7 signals
General: 2 classified signals
Disclosure: 2 classified signals
Peaked 4d ago at 2 mentions (2026-09-17); latest day: 1
9 total mentions across 7 days

Affected systems

Vendors

tp-link

Products

tapo_c120tapo_c120_firmwaretapo_c200tapo_c200_firmware

2 versions affected across 4 products

Deep dive

Activity timeline9 mentions / 7d

Signal classification3 categories

Patch

555.6%

General

222.2%

Disclosure

222.2%

Referenced assets7 URLs

By indicator

Classification over time

Date	Total	Labels

2026-08-28	1	General1
2026-09-16	1	Patch1
2026-09-17	2	Disclosure1Patch1
2026-09-18	2	Disclosure1General1
2026-09-19	1	Patch1
2026-09-23	1	Patch1
2026-09-28	1	Patch1

Full discourse9 posts

elhacker.NET@elhackernet26d
Disclosure
Vulnerabilidades 0-day en cámaras TP-Link permiten espiar usuarios Se han detectado dos vulnerabilidades de día cero (CVE-2026-15315 y CVE-2026-15316) en las cámaras inteligentes TP-Link Tapo C200 https://blog.elhacker.net/2026/09/vulnerabilidades-0-day-en-camaras-tp.html
Post summary
The text announces the discovery of two zero-day vulnerabilities (CVE-2026-15315 and CVE-2026-15316) in TP-Link Tapo C200 cameras that enable user surveillance, directing readers to a blog post for further information.
16721748015.4K
142.5K followersView on X
Sekurak@Sekurak15d
Patch
🚨 Popularne kamery TP–Link Tapo C200 z poważnymi błędami bezpieczeństwa 🛠️ Badacze z OPSWAT wykryli 3 podatności, z czego 2 z nich otrzymały identyfikatory CVE-2026-15315 i CVE-2026-15316. Ostatnia jest w trakcie odpowiedzialnego ujawniania (rozmowy z przedstawicielami TP–Link). 💻 Wykryte błędy umożliwiają zdobycie dostępu do panelu administracyjnego bez znajomości hasła oraz przeprowadzenie ataków typu DoS. 🛑 Jest jeden warunek, atakujący musi być w tej samej sieci co kamery. 🛡️ Producent wydał łatkę bezpieczeństwa. Zalecamy aktualizację urządzeń do wersji V5_1.4.6 lub nowszej. 👉 Szczegóły: https://sekurak.pl/powazne-podatnosci-w-popularnych-kamerach-tp-link-tapo-c200-z-poziomu-sieci-lokalnej-mozna-bylo-zdobyc-uprawnienia-administratora-lub-przeprowadzic-dos/
Post summary
Researchers from OPSWAT disclosed three vulnerabilities in TP-Link Tapo C200 cameras (two assigned CVEs CVE-2026-15315 and CVE-2026-15316), enabling unauthorized admin panel access without password and DoS attacks from the local network; the vendor has released a security patch urging upgrade to firmware V5_1.4.6 or newer.
3303643.7K
45.1K followersView on X
Max Aitel@AitelMax46d
General
Found entirely through gpt5.5 prompts https://www.cve.org/CVERecord?id=CVE-2026-15315
Post summary
The user reports finding CVE-2026-15315 via GPT prompts and shares the cve.org link, but supplies no further details or evidence of exploitation.
21218116.8K
331 followersView on X
Rıdvan Yağlı@ridvanyagli27d
Patch
🔴 TP-Link Tapo C200 model güvenlik kamerası ürününde iki güvenlik açığı tespit edildi! CVE-2026-15315: Aynı ağdaki kimlik doğrulanmamış saldırgan, authentication mekanizmasını aşarak yönetici oturumu elde edebiliyor. Bu durum kamera görüntülerine ve yönetim işlevlerine erişim riski oluşturuyor. Erişim sonrası saldırgan sizi izleyebiliyor. CVE-2026-15316: Kimlik doğrulama gerektirmeyen saldırgan, özel hazırlanmış veriler göndererek kameranın HTTPS servisini çökertebiliyor (DoS). Tapo C200 V5 için açıklar V5_1.4.6 Build 260709 sürümünde düzeltildi. Kameranızı güncelleyin.
Post summary
Two vulnerabilities in the TP-Link Tapo C200 camera were disclosed, one allowing unauthenticated admin session takeover and another enabling DoS via crafted HTTPS requests; a firmware update (V5_1.4.6 Build 260709) is provided as a fix and users are urged to update.
2301321.4K
2.4K followersView on X
セキュリティ対策Lab@securityLab_jp26d
General
TP-Link Tapo C120/C200に認証回避脆弱性CVE-2026-15315　パスワードなしで管理者セッション取得の可能性 https://rocket-boys.co.jp/security-measures-lab/tapo-c120-c200-cve-2026-15315-report/ #セキュリティ対策Lab #security #securitynews #セキュリティ #脆弱性
Post summary
The tweet reports a new authentication bypass vulnerability (CVE‑2026‑15315) in TP‑Link Tapo C120/C200 that may allow admin session acquisition without a password, but provides no PoC, exploit, patch, or evidence of active exploitation.
00010204
691 followersView on X
Windows Forum@windowsforum20d
Patch
📹 Your Tapo camera’s password wasn’t the only thing standing between intruders and your footage: a same-network attacker could get admin access. Update the firmware—your Wi‑Fi isn’t a security boundary. https://windowsforum.com/news/cve-2026-15315-tapo-c120-v1-c200-v5-firmware-fixes-admin-bypass.445681/?utm_source=x&utm_medium=social&utm_campaign=news_node4 #FirmwareUpdates #CameraSecurity #TpLinkTapo https://t.co/FauM3UnLST
Post summary
The post warns that Tapo cameras are vulnerable to an admin bypass allowing same-network attackers to gain admin access, and urges users to update firmware to fix the issue.
0000055
1.4K followersView on X
ΤechΜaniacs@techmaniacsgr24d
Patch
TP-Link Tapo: Κενό ασφαλείας, επιτρέπει τον οποιοδήποτε να δει εικόνα καμερών [και στην Ελλάδα] Εντοπίστηκαν σοβαρές ευπάθειες ασφαλείας (CVE-2026-15315, CVE-2026-15316) στις κάμερες TP-Link Tapo C200. Κάντε ενημέρωση https://techmaniacs.gr/tp-link-tapo-c200-efpatheia-asfaleias
Post summary
The text announces critical vulnerabilities in TP-Link Tapo C200 cameras (CVE-2026-15315 and CVE-2026-15316) that allow unauthorized access to camera footage and urges users to apply an update/patch.
00000147
3.8K followersView on X
Kujikujira@midvilkujira25d
Disclosure
TP-Link Tapo C120/C200に認証回避脆弱性CVE-2026-15315　パスワードなしで管理者セッション取得の可能性 https://rocket-boys.co.jp/security-measures-lab/tapo-c120-c200-cve-2026-15315-report/
Post summary
The text announces CVE-2026-15315 affecting TP-Link Tapo C120/C200 devices, describing it as an authentication bypass that could allow an administrator session to be obtained without a password. It does not mention PoC code, exploit tools, active exploitation, or remediation.
0000055
120 followersView on X
The Daily Tech Feed@dailytechonx27d
Patch
Urgent for anyone running TP-Link Tapo C200 cameras: two zero-day vulnerabilities—an auth bypass (CVE-2026-15315) and DoS flaw (CVE-2026-15316)—were patched in firmware V5_1.4.6 on August 18, 2026. Attackers sharing your network could access your camera’s admin functions or crash its service. Tighten your Wi-Fi security and isolate IoT devices until you’ve updated—all things that matter for privacy & security. #Security #IoT #TPLink #Vulnerability #TechNews #Cybersecurity https://thedailytechfeed.com/tp-link-tapo-c200-cameras-had-critical-0-day-flaws-allowing-remote-control/
Post summary
Two zero‑day CVEs (auth bypass and DoS) in TP‑Link Tapo C200 cameras were disclosed, with a firmware update (V5_1.4.6) released on August 18 2026 that fixes the issues; attackers could gain admin access or crash services, but no active exploitation was reported.
0000088
737 followersView on X

CPE platform detail4 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

4 of 4 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	tp-link	tapo_c120	-	-	-
OS	tp-link	tapo_c120_firmware	-	-	-
HW	tp-link	tapo_c200	5.0	-	-
OS	tp-link	tapo_c200_firmware	-	-	-

Explore more

Back to dashboard tp-link CVEs tapo_c120 vulnerabilities

What researchers are saying

CVE-2026-15315

Sekurak[verified]@SekurakPatch

Researchers from OPSWAT disclosed three vulnerabilities in TP-Link Tapo C200 cameras (two assigned CVEs CVE-2026-15315 and CVE-2026-15316), enabling unauthorized admin panel access without password and DoS attacks from the local network; the vendor has released a security patch urging upgrade to firmware V5_1.4.6 or newer.

Max Aitel[verified]@AitelMaxGeneral

The user reports finding CVE-2026-15315 via GPT prompts and shares the cve.org link, but supplies no further details or evidence of exploitation.

Rıdvan Yağlı[verified]@ridvanyagliPatch

Two vulnerabilities in the TP-Link Tapo C200 camera were disclosed, one allowing unauthenticated admin session takeover and another enabling DoS via crafted HTTPS requests; a firmware update (V5_1.4.6 Build 260709) is provided as a fix and users are urged to update.

セキュリティ対策Lab[verified]@securityLab_jpGeneral

The tweet reports a new authentication bypass vulnerability (CVE‑2026‑15315) in TP‑Link Tapo C120/C200 that may allow admin session acquisition without a password, but provides no PoC, exploit, patch, or evidence of active exploitation.

Windows Forum[verified]@windowsforumPatch

The post warns that Tapo cameras are vulnerable to an admin bypass allowing same-network attackers to gain admin access, and urges users to update firmware to fix the issue.

The Daily Tech Feed[verified]@dailytechonxPatch

Two zero‑day CVEs (auth bypass and DoS) in TP‑Link Tapo C200 cameras were disclosed, with a firmware update (V5_1.4.6) released on August 18 2026 that fixes the issues; attackers could gain admin access or crash services, but no active exploitation was reported.

elhacker.NET@elhackernetDisclosure

The text announces the discovery of two zero-day vulnerabilities (CVE-2026-15315 and CVE-2026-15316) in TP-Link Tapo C200 cameras that enable user surveillance, directing readers to a blog post for further information.

ΤechΜaniacs@techmaniacsgrPatch

The text announces critical vulnerabilities in TP-Link Tapo C200 cameras (CVE-2026-15315 and CVE-2026-15316) that allow unauthorized access to camera footage and urges users to apply an update/patch.