CVE-2026-12760
Full vulnerability record from the local CVENow database.
Description
A denial-of-service (DoS) vulnerability has been identified in Tapo C200 v3 in the network packet handling logic due to improper handling of IPv4 fragmented packets. An unauthenticated adjacent attacker can send crafted packets to cause excessive resource consumption, leading to instability of the device.Successful exploitation can remotely trigger a temporary denial-of-service condition, causing the camera to become unresponsive and resulting in intermittent loss of video monitoring and recording.
Severity
HIGH
CVSS score
7.1
(v4.0)
Vulnerability status
Analyzed
Source identifier
f23511db-6c3e-4e32-a477-6aa17d310630
Published
2026-06-24 19:17:08.237000
Last modified
2026-10-25 22:10:00.150000
View original CVE JSON
{
"id": "CVE-2026-12760",
"sourceIdentifier": "f23511db-6c3e-4e32-a477-6aa17d310630",
"published": "2026-06-24T19:17:08.237",
"lastModified": "2026-10-25T22:10:00.150",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A denial-of-service (DoS) vulnerability has been identified in Tapo C200 v3 in the network packet handling logic due to improper handling of IPv4 fragmented packets. An unauthenticated adjacent attacker can send crafted packets to cause excessive resource consumption, leading to instability of the device.Successful exploitation can remotely trigger a temporary denial-of-service condition, causing the camera to become unresponsive and resulting in intermittent loss of video monitoring and recording."
},
{
"lang": "es",
"value": "Una vulnerabilidad de denegación de servicio (DoS) ha sido identificada en Tapo C200 v3 en la lógica de manejo de paquetes de red debido a un manejo inadecuado de paquetes IPv4 fragmentados. Un atacante adyacente no autenticado puede enviar paquetes manipulados para causar un consumo excesivo de recursos, lo que lleva a la inestabilidad del dispositivo. La explotación exitosa puede desencadenar remotamente una condición temporal de denegación de servicio, haciendo que la cámara deje de responder y resultando en una pérdida intermitente de monitoreo y grabación de video."
}
],
"affected": [
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"affectedData": [
{
"vendor": "TP-Link Systems Inc.",
"product": "Tapo C200 v3",
"defaultStatus": "unaffected",
"platforms": [
"NVMP"
],
"versions": [
{
"version": "0",
"lessThan": "1.4.4 Build 250922",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "ADJACENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "ADJACENT_NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-06-24T18:53:30.462879Z",
"id": "CVE-2026-12760",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-770"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.3:build_230228:*:*:*:*:*:*",
"matchCriteriaId": "CABD8DE6-9904-499D-919F-9DBD42BE6762"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.4:build_230424:*:*:*:*:*:*",
"matchCriteriaId": "254031B5-7CC7-4B9D-970B-FAA6EBC3EAFD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.5:build_230717:*:*:*:*:*:*",
"matchCriteriaId": "9D61B481-8262-44D4-9A1D-9967AB1805DC"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.7:build_230920:*:*:*:*:*:*",
"matchCriteriaId": "50D2F368-F8C8-41E1-9360-8CDF9F89E566"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.9:build_231019:*:*:*:*:*:*",
"matchCriteriaId": "EF80958C-4274-4DEA-9730-176E3E6F21F2"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.11:build_231115:*:*:*:*:*:*",
"matchCriteriaId": "7AA1B7FA-D418-46B2-A530-BF67E550E38F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.13:build_240327:*:*:*:*:*:*",
"matchCriteriaId": "DC4382B5-C7EC-4B98-AF28-8D08D0771133"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.14:build_240513:*:*:*:*:*:*",
"matchCriteriaId": "1FCE1F5E-E84B-4CF4-B8A4-7A3448A0D127"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.15:build_240715:*:*:*:*:*:*",
"matchCriteriaId": "C05AC5C2-5BB7-499A-AE2B-414103317D47"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.1:build_241212:*:*:*:*:*:*",
"matchCriteriaId": "C1ED28D6-9441-440A-81D8-EB539D50BB56"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.2:build_250313:*:*:*:*:*:*",
"matchCriteriaId": "51E28752-8B46-48CD-86B5-437449AED7C0"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:h:tp-link:tapo_c200:3:*:*:*:*:*:*:*",
"matchCriteriaId": "101FA54E-1A3D-4A38-BBD0-8DAFAC414EA3"
}
]
}
]
}
],
"references": [
{
"url": "https://www.tp-link.com/en/support/download/tapo-c200/v3/#Firmware-Release-Notes",
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Release Notes"
]
},
{
"url": "https://www.tp-link.com/us/support/download/tapo-c200/v3/#Firmware-Release-Notes",
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Release Notes"
]
},
{
"url": "https://www.tp-link.com/us/support/faq/5143/",
"source": "f23511db-6c3e-4e32-a477-6aa17d310630",
"tags": [
"Vendor Advisory"
]
}
]
}