Information Disclosure in Tapo C120 and C200 Cameras

Executive Summary

This vulnerability affects Tapo C120 v1 and C200 V5 devices. It involves a missing authentication check in the HTTPS onboarding scan function. An unauthenticated attacker on the same local network can trigger the scan action and retrieve metadata about nearby wireless access points, including SSIDs, BSSIDs, encryption modes, and signal strength.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for unauthorized HTTPS scan requests on the local network targeting Tapo C120 or C200 devices. Monitor network traffic for HTTPS POST requests to the scan endpoint without prior authentication. Use tools like Wireshark to capture and inspect traffic for SSID, BSSID, or signal-strength metadata being transmitted.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gather information about your local wireless network environment. This includes learning details about nearby access points, which might help in planning further attacks or mapping your network topology without your knowledge.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may expose wireless network metadata (SSIDs, encryption modes) which could indirectly aid in unauthorized network access. For GDPR, this could relate to risks of unauthorized data collection or network intrusion. For HIPAA, it might affect safeguards for protected health information if network access is compromised.

Useful 0 Not Useful 0

Mitigation Strategies

Disable the HTTPS onboarding scan function on affected Tapo C120 v1 and C200 V5 devices to prevent unauthenticated access to wireless network metadata.

Useful 0 Not Useful 0