CVE-2026-15316

Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200

No known exploitation. EPSS puts it in the 13th percentile. A vendor fix is available.

CVSS 3.16.5Medium EPSS percentile13th0.2% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-08-18Updated 2026-09-04Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether you use a Tapo C200 v5 and record its installed firmware version in the Tapo app or camera management page.
Update affected cameras to firmware 1.4.6; for the v5 release, install V5_1.4.6 Build 260709 Rel.27675n.
Until updated, keep the camera configuration service accessible only from trusted local network devices.
After updating, confirm the camera stays online and HTTPS management access works normally.

Vendor advisory Usually a quick update

What it is

From the CVE record

An improper input validation vulnerability in the configuration service for processing encrypted credential data has been identified in Tapo C200 v5. An attacker can send oversized crypted ciphertext values that may trigger exception handling failures, due to insufficient validation, causing the affected device to crash or restart. Successful exploitation may temporarily disrupt HTTPS management and monitoring functionality, resulting in a denial-of-service (DoS) condition until the service recovers.

In plain language

Written by AI from the record

Tapo C200 v5 cameras running firmware earlier than 1.4.6 can be forced to restart by someone on your local network, disrupting camera monitoring and management.

Unauthenticated adjacent-network denial of service in the Tapo C200 v5 configuration service: oversized encrypted credential input triggers exception-handling failures and restarts the device.

If you're affected

Camera monitoring interruption
Management access outage
Repeated device restarts
Security coverage gaps

What is it

This issue lets a nearby network attacker send an abnormally large piece of setup information that makes the camera restart. It is like repeatedly tripping a circuit breaker: the camera is not taken over, but it can be temporarily unavailable when you need it.

Who is affected

This matters to you if you run a TP-Link Tapo C200 v5 camera. It is a risk only when an attacker is on the same local network and can reach the camera’s configuration service port.

How urgent is it

An attacker on the local network can deliberately crash the camera, creating immediate gaps in monitoring and management access. Treat this as urgent and install the available update promptly, especially on networks shared with guests, contractors, or untrusted devices.

What to do — in detail

Confirm the device is a Tapo C200 v5, identify its current firmware version, and determine whether its configuration service can be reached by untrusted devices on the local network. Upgrade to firmware 1.4.6; the v5-specific fixed release is V5_1.4.6 Build 260709 Rel.27675n. Follow TP-Link’s firmware update instructions for the device, then verify that the camera remains online and its HTTPS management interface is available after the upgrade.

If patching must be delayed, isolate the camera on a trusted network segment and restrict access to its configuration service port to approved administration devices. There is no CISA KEV due date because this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. Monitor for unexpected camera restarts, loss of HTTPS management access, and repeated availability interruptions.

Technical context

CVE-2026-15316 is a CVSS 6.5 Medium vulnerability (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), classified as CWE-20 improper input validation. An adjacent-network attacker can send oversized encrypted credential data to the configuration service, causing exception-handling failures and a crash or restart. No public exploit code, confirmed in-the-wild exploitation, or CISA KEV listing is reported. EPSS is 0.2% (14th percentile) with a flat trend; this is a prediction, not evidence of exploitation. Press attention is rising due to a roundup, not a confirmed incident.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS13th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.2% chance of exploitation activity in the next 30 days, which ranks it in the 13th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 17 days, from the signal feeds we watch.

2026-09-04Patch availablerecord updated
2026-08-28Record updated
2026-08-20Record updated
2026-08-18Publishedweakness classified, att&ck mapped, record updated

Affected products

TP-Link Systems Inc.commercial · CNaka tp-link
- Tapo C200 v5Networking Infrastructure
tp-linkcommercial · TWaka tp link
- tapo c200 firmwareNetworking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Scored 6.5 by NVD.

How it is reached

Attack Vector AdjacentRequires access to the local network (e.g. same Wi-Fi, Bluetooth)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable