Vulnerability Description
An improper input validation vulnerability in the configuration service for processing encrypted credential data has been identified in Tapo C200 v5. An attacker can send oversized crypted ciphertext values that may trigger exception handling failures, due to insufficient validation, causing the affected device to crash or restart. Successful exploitation may temporarily disrupt HTTPS management and monitoring functionality, resulting in a denial-of-service (DoS) condition until the service recovers.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Tp-Link | Tapo C200 Firmware | < 1.4.6 |
| Tp-Link | Tapo C200 | 5.0 |
Related Weaknesses (CWE)
References
- https://www.tp-link.com/en/support/download/tapo-c200/v5/ProductRelease Notes
- https://www.tp-link.com/us/support/download/tapo-c200/v5/ProductRelease Notes
- https://www.tp-link.com/us/support/faq/5248/Vendor Advisory
FAQ
What is CVE-2026-15316?
CVE-2026-15316 is a vulnerability with a CVSS score of 6.5 (MEDIUM). An improper input validation vulnerability in the configuration service for processing encrypted credential data has been identified in Tapo C200 v5. An attacker can send oversized crypted ciphertext...
How severe is CVE-2026-15316?
CVE-2026-15316 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-15316?
Check the references section above for vendor advisories and patch information. Affected products include: Tp-Link Tapo C200 Firmware, Tp-Link Tapo C200.