CVE-2026-15316

Analyzed Analyzed - Analysis Complete

Improper Input Validation in Tapo C200 Configuration Service

Publication date: 2026-08-18

Last updated on: 2026-09-04

Assigner: TPLink

Description

An improper input validation vulnerability in the configuration service for processing encrypted credential data has been identified in Tapo C200 v5. An attacker can send oversized crypted ciphertext values that may trigger exception handling failures, due to insufficient validation, causing the affected device to crash or restart. Successful exploitation may temporarily disrupt HTTPS management and monitoring functionality, resulting in a denial-of-service (DoS) condition until the service recovers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-09-04

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-15316

EUVD

EUVD-2026-62194

Affected Vendors & Products

Vendor	Product	Version / Range
tp-link	tapo_c200_firmware	to 1.4.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper input validation issue in the configuration service of Tapo C200 v5 that processes encrypted credential data. An attacker can send oversized encrypted ciphertext values, which may cause exception handling failures due to insufficient validation. This can lead to the device crashing or restarting.

Detection Guidance

This vulnerability involves improper input validation in the Tapo C200 configuration service. Detection may require monitoring device logs for crashes or restarts during encrypted credential processing. Check for HTTPS management disruptions or unusual traffic patterns targeting the device.

Impact Analysis

Exploitation may temporarily disrupt HTTPS management and monitoring functionality, causing a denial-of-service (DoS) condition until the service recovers. The device may crash or restart repeatedly.

Compliance Impact

This vulnerability causes temporary disruption of HTTPS management and monitoring functionality, leading to a denial-of-service condition. Such disruptions could impact data availability and integrity, which are critical for compliance with standards like GDPR and HIPAA that require continuous access to personal or health data.

Mitigation Strategies

Immediately update the Tapo C200 firmware to the latest version if a patch is available. Isolate the device from untrusted networks. Monitor for crashes or service disruptions and restrict access to the device's configuration interface.

Hi! I’m here to help you understand CVE-2026-15316. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70