CVE-2026-1871
Medium
Description
TP-Link Tapo C200 v5 contains a stack-based buffer overflow flaw in RTSP authentication handling due to improper validation of Authorization header field lengths, which can be triggered by a crafted authentication request. Successful exploitation causes the affected RTSP core service process to crash and triggers an automatic system reboot, resulting in a denial of service (DoS) condition. This prevents legitimate users from accessing the camera’s live video stream or management interface until the service restarts.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Tp-link Tapo C200 Firmware
PublishedJun 2, 2026
First seenJun 2, 2026
Weakness typeCWE-121CWE-121
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tp-link tapo_c200_firmware | 1.0.5, 1.0.12, 1.0.13, 1.0.17, 1.1.4, 1.1.8, 1.2.3, 1.3.1, 1.3.3, 1.3.5 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.