CVE-2026-78577: Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200
Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, an unauthenticated attacker on the same local network can invoke the scan action and retrieve nearby wireless access-point metadata, including SSIDs, BSSIDs, authentication and encryption modes, and signal-strength information.
Successful exploitation may disclose information about the wireless environment surrounding the camera, allowing an attacker to learn elements of the local wireless topology.
Affected Software
Event History
Frequently Asked Questions
Which devices and deployments are exposed?
The affected products are TP-Link Tapo C120 v1 and Tapo C200 V5. Exposure applies after initial setup when an attacker can access the same local network as the camera.
What does an attacker need to exploit this issue?
The attacker does not need to authenticate, but must be on the same local network and able to invoke the camera's HTTPS onboarding scan action.
What information can be obtained?
The scan response can reveal nearby wireless access-point metadata, including SSIDs, BSSIDs, authentication and encryption modes, and signal-strength information. This can disclose details of the wireless topology around the camera.