CVE-2026-12760: Tapo C200 Camera DoS Vulnerability

CVE-2026-12760 Overview

CVE-2026-12760 is a denial-of-service (DoS) vulnerability in the TP-Link Tapo C200 v3 network camera. The flaw resides in the network packet handling logic and stems from improper handling of IPv4 fragmented packets. An unauthenticated attacker on an adjacent network can send crafted fragmented packets to trigger excessive resource consumption on the device. Successful exploitation causes the camera to become unresponsive, producing intermittent loss of video monitoring and recording. The weakness is classified under [CWE-770] (Allocation of Resources Without Limits or Throttling).

Critical Impact
An unauthenticated adjacent attacker can remotely render the Tapo C200 v3 camera unresponsive, disrupting live monitoring and recorded video evidence.

Affected Products

TP-Link Tapo C200 v3 network camera
Firmware versions prior to the vendor-released fix referenced in the TP-Link release notes
Deployments exposing the camera on networks reachable by adjacent attackers

Discovery Timeline

2026-06-24 - CVE-2026-12760 published to the National Vulnerability Database (NVD)
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-12760

Vulnerability Analysis

The vulnerability exists in the IPv4 reassembly and packet-handling routines of the Tapo C200 v3 firmware. The device fails to enforce reasonable limits when processing fragmented IPv4 datagrams. An attacker can transmit a sustained stream of crafted fragments that the camera attempts to buffer and reassemble. The resource cost of holding these fragments exhausts memory or CPU available to the embedded network stack.

Once internal limits are exceeded, the camera stops servicing legitimate connections. Live RTSP and Tapo cloud streams stall, and on-device recording pauses until the device recovers or is rebooted. The condition is temporary but can be repeatedly induced for as long as the attacker maintains the traffic pattern.

Root Cause

The root cause is missing throttling and lifetime controls on IPv4 fragment reassembly buffers, consistent with [CWE-770]. The firmware does not cap the number of in-flight fragments, total bytes held for reassembly, or per-source allocation. Malformed or intentionally incomplete fragment chains accumulate until the network subsystem can no longer service inbound traffic.

Attack Vector

The attack requires adjacent network access, meaning the attacker must reside on the same broadcast or routed segment as the camera, such as a shared Wi-Fi network. No authentication and no user interaction are required. The attacker crafts IPv4 packets with overlapping, oversized, or never-completed fragments and transmits them at volume toward the camera's IP address. Confidentiality and integrity are not affected, but availability of the camera service is lost for the duration of the attack.

No public proof-of-concept exploit code is available for CVE-2026-12760. The vulnerability is described conceptually in the TP-Link advisory; refer to the TP-Link Firmware Release Notes for vendor technical details.

Detection Methods for CVE-2026-12760

Indicators of Compromise

Tapo C200 v3 cameras becoming unresponsive to the Tapo mobile app, ping, or RTSP requests without a corresponding power or Wi-Fi outage
Gaps in cloud or local recording timelines that correlate with bursts of inbound IPv4 fragmented traffic
High volumes of inbound IPv4 packets to the camera with the More Fragments (MF) flag set or non-zero fragment offsets that never complete reassembly

Detection Strategies

Inspect network telemetry for sustained IPv4 fragment streams directed at IoT camera IP addresses, especially from wireless clients on the same VLAN
Alert on repeated camera disconnect and reconnect events in the Tapo cloud or local NVR logs
Use intrusion detection signatures that flag abnormal fragment-to-complete-datagram ratios per source

Monitoring Recommendations

Forward IoT VLAN flow logs and wireless controller events into a centralized analytics platform for correlation with camera availability
Track uptime and stream-health metrics for each Tapo C200 v3 endpoint to detect repeated short outages
Review DHCP and ARP tables for unexpected hosts on the camera VLAN that could serve as an adjacent attack staging point

How to Mitigate CVE-2026-12760

Immediate Actions Required

Update the Tapo C200 v3 to the latest firmware listed in the TP-Link Firmware Release Notes
Place cameras on a dedicated IoT VLAN isolated from guest and untrusted user networks
Restrict adjacent network access by enforcing WPA3 or strong WPA2 credentials on Wi-Fi segments hosting the cameras
Verify firmware version through the Tapo app after the update and confirm streams resume normal operation

Patch Information

TP-Link has published updated firmware for the Tapo C200 v3 that addresses the improper IPv4 fragmented packet handling. Download instructions and version details are available in the TP-Link Firmware Release Notes. Additional guidance on the update procedure is provided in the TP-Link Support FAQ.

Workarounds

Apply firewall or router rules that drop or rate-limit inbound IPv4 fragments destined for camera IP addresses
Enable client isolation on the wireless network to prevent peer-to-peer traffic between user devices and the camera
Segment cameras behind a router that performs full IPv4 reassembly before forwarding, shifting reassembly load off the device
Monitor and physically reboot affected cameras if a denial-of-service condition is observed until firmware can be applied

bash

# Example: rate-limit inbound IPv4 fragments to a camera using iptables on an upstream Linux gateway
iptables -A FORWARD -d <camera_ip> -f -m limit --limit 20/second --limit-burst 40 -j ACCEPT
iptables -A FORWARD -d <camera_ip> -f -j DROP