CVE-2026-15316

CVE-2026-15316 is an improper input validation flaw (CWE-20) in the configuration service of the TP-Link Tapo C200 camera (v5) that processes encrypted credential data. An attacker on an adjacent network can send oversized ciphertext values with no authentication required; insufficient validation causes exception-handling failures that crash or restart the device. The impact is a denial-of-service condition that temporarily disrupts HTTPS management and monitoring until the service recovers, with no confidentiality or integrity impact per the CVSS vector. Anyone running a Tapo C200 v5 camera is affected, though exploitation requires the attacker to reach the device's network (adjacent-network vector). No public proof-of-concept exists, the issue is not in CISA KEV, and EPSS estimates only a 0.2% chance of exploitation within 30 days.

What to do: Check your Tapo C200 firmware version in the Tapo app and apply TP-Link's firmware update for v5 when released. In the meantime, keep the camera's management interface off guest/WAN-exposed network segments and restrict it to trusted LANs, since the attack is unauthenticated and adjacent-network. Note that related reporting on TP-Link camera flaws (including eavesdropping issues) makes prompt patching of Tapo devices generally advisable.