CVE-2026-102369: Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200
Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service that becomes accessible after a reboot, and submit crafted input to execute arbitrary commands within the device management process.
Successful exploitation may allow arbitrary command execution on the camera and compromise the confidentiality, integrity, and availability of the affected device. Exploitation requires access from the same local network, replay of the login challenge data, activation of the privileged service, and a device reboot.
Affected Software
Event History
Frequently Asked Questions
Which devices and deployments are exposed?
The affected products are TP-Link Tapo C120 v1 and Tapo C200 V5. Exploitation is limited to attackers who can access the same local network as the camera.
Does exploitation require an existing account or authentication?
No. An unauthenticated attacker can replay login challenge data to obtain an administrative session, then use that access to enable the privileged service involved in exploitation.
What conditions must an attacker satisfy to achieve command execution?
The attacker needs same-local-network access, login challenge data that can be replayed, and the ability to enable the privileged service. The device must then reboot before the service becomes accessible, after which crafted MacTool input can execute commands in the device management process.
What is the likely impact if exploitation succeeds?
Successful exploitation can allow arbitrary command execution on the camera. This may compromise the confidentiality, integrity, and availability of the affected device.