TP-Link Systems Inc Tapo c120 v1 vulnerabilities

4 CVEs affecting TP-Link Systems Inc Tapo c120 v1, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-9032, published 2026-10-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-78578, published 2026-10-01. High severity, CVSS 7.1. EPSS: 0.2% chance of exploitation in the next 30 days. Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup. An unauthenticated adjacent attacker can submit unauthorized wireless…
CVE-2026-102369, published 2026-10-01. High severity, CVSS 8.7. EPSS: 0.2% chance of exploitation in the next 30 days. Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network…
CVE-2026-78577, published 2026-10-01. Medium severity, CVSS 5.3. EPSS: 0.1% chance of exploitation in the next 30 days. Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, an unauthenticated attacker on the same local network…
CVE-2026-9032, published 2026-10-01. High severity, CVSS 7.1. EPSS: 0.1% chance of exploitation in the next 30 days. Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not…