CVE-2026-78578: Tapo Camera Authentication Bypass DoS Flaw

CVE-2026-78578 Overview

CVE-2026-78578 affects TP-Link Tapo C120 v1 and Tapo C200 v5 Wi-Fi cameras. The devices do not enforce authentication for the HTTPS onboarding connect action's do method after initial setup completes. An unauthenticated attacker on the adjacent network can submit arbitrary wireless configuration parameters to the camera. The camera then attempts to associate with an attacker-specified network, disconnecting from its legitimate wireless network. This results in a denial-of-service condition because the camera becomes unreachable at its management address. The weakness is classified as Missing Authentication for Critical Function [CWE-306].

Critical Impact
An adjacent-network attacker can force a Tapo C120 or C200 camera to leave its wireless network without credentials, cutting off video feeds and management access.

Affected Products

TP-Link Tapo C120 v1
TP-Link Tapo C200 v5
Firmware versions prior to the vendor-published fixes referenced in the Tapo C120 v1.26 and Tapo C200 v5 firmware release notes

Discovery Timeline

2026-10-01 - CVE-2026-78578 published to NVD
2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-78578

Vulnerability Analysis

The Tapo C120 and C200 cameras expose an HTTPS onboarding endpoint used during initial device provisioning. This endpoint accepts a do method with a connect action that writes wireless station parameters such as SSID, security type, and pre-shared key. The endpoint should only be reachable prior to completion of initial setup. On the affected firmware, the endpoint continues to accept unauthenticated requests after setup, allowing any adjacent-network peer to overwrite the camera's wireless configuration. The result is a loss of availability for the camera's video and management functions [CWE-306].

Root Cause

The root cause is a missing authentication check on a privileged state-changing operation. The onboarding handler trusts any caller that can reach it on the local link, under the assumption that only a provisioning client would use the method. The handler never transitions to an authenticated code path after onboarding ends, leaving a post-setup window in which configuration writes remain anonymous.

Attack Vector

Exploitation requires network adjacency, such as presence on the same Wi-Fi segment or a bridged LAN segment that reaches the camera. The attacker issues an HTTPS request to the onboarding interface invoking the do method with a connect action carrying attacker-controlled Wi-Fi parameters. The camera accepts the parameters, disassociates from its current access point, and attempts to associate with the attacker-supplied SSID. If association fails or the specified network is not controlled by the owner, the camera becomes unreachable, producing a denial-of-service condition. User interaction is not required and no credentials are needed.

No verified proof-of-concept code has been published. Refer to the TP-Link Tapo C120 FAQ and firmware release notes for vendor technical detail.

Detection Methods for CVE-2026-78578

Indicators of Compromise

Tapo C120 or C200 cameras that become unreachable at their configured management IP without a corresponding power or network outage.
Unexpected disassociation events for Tapo camera MAC addresses in wireless controller logs.
Tapo cameras appearing associated to an SSID that does not match the organization's wireless infrastructure.

Detection Strategies

Monitor HTTPS traffic to Tapo camera IP addresses for POST requests invoking the onboarding do method after the device has completed initial setup.
Alert on wireless controller events showing Tapo-vendor OUI devices leaving the corporate SSID and probing unknown SSIDs.
Correlate loss of RTSP or Tapo cloud heartbeat traffic with recent 802.11 management frame activity near the camera.

Monitoring Recommendations

Baseline the expected wireless association behavior of Tapo cameras and alert on deviations in BSSID or SSID.
Collect DHCP and ARP telemetry on the camera VLAN to detect cameras that disappear and reappear with different network parameters.
Centralize camera availability monitoring so DoS conditions trigger alerts rather than silent outages.

How to Mitigate CVE-2026-78578

Immediate Actions Required

Upgrade affected Tapo C120 v1 devices to the firmware version referenced in the TP-Link Tapo C120 Firmware Release Notes.
Upgrade affected Tapo C200 v5 devices to the firmware version referenced in the TP-Link Tapo C200 Firmware Release Notes.
Inventory all Tapo cameras on managed and guest wireless networks and verify firmware versions post-update.

Patch Information

TP-Link has published updated firmware for the Tapo C120 (v1.26 branch) and Tapo C200 v5. Consult the TP-Link Tapo C120 FAQ for installation guidance and the vendor firmware release notes for the specific build that addresses the missing authentication check in the onboarding do method.

Workarounds

Isolate Tapo cameras on a dedicated VLAN or SSID that restricts adjacent-network access to trusted management hosts only.
Enable wireless client isolation on the access point serving the cameras to prevent peer-to-peer HTTPS requests from reaching the onboarding endpoint.
Restrict physical and RF access to the camera network to reduce the pool of potential adjacent attackers until firmware updates are applied.

bash

# Example: isolate Tapo cameras on a dedicated SSID with client isolation
# (syntax varies by access point vendor; verify against your platform documentation)
set wireless ssid "IoT-Cameras" client-isolation enable
set wireless ssid "IoT-Cameras" vlan 42
set firewall vlan 42 allow from mgmt-hosts to cameras tcp 443
set firewall vlan 42 deny from any to cameras tcp 443