CVE-2026-15316: Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200
An improper input validation vulnerability in the configuration service for processing encrypted credential data has been identified in Tapo C200 v5. An attacker can send oversized crypted ciphertext values that may trigger exception handling failures, due to insufficient validation, causing the affected device to crash or restart.
Successful exploitation may temporarily disrupt HTTPS management and monitoring functionality, resulting in a denial-of-service (DoS) condition until the service recovers.
Affected Software
Event History
Frequently Asked Questions
Which devices and functions are affected?
TP-Link Tapo C200 v5 is identified as affected. The issue can disrupt the device's HTTPS management and monitoring functionality by causing the device to crash or restart.
What access does an attacker need to trigger the denial of service?
An attacker needs to be able to send oversized encrypted credential ciphertext values to the configuration service. The provided information does not state that authentication is required.
How can I recognize a possible exploitation attempt or impact?
The vulnerability is triggered by oversized crypted ciphertext input that is insufficiently validated, which can cause exception-handling failures. A crash or restart and temporary loss of HTTPS management or monitoring availability are indicators of exploitation.