Description (CNA)
The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS).
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| TP-Link Systems Inc. / Tapo C200 | affected 0 before V3_1.4.5 Build 251104; affected 0 before V5_1.4.6 Build 260709 Rel.27675n |
| TP Link Systems Inc. / Tapo C100 v5 | affected 0 before V5_1.4.4 Build 260303 |
| TP Link Systems Inc. / Tapo C425 v1.2 | affected 0 before V1.20_1.2.27 Build 260518 |
CWE
CWE-306
References
- https://www.tp-link.com/us/support/download/tapo-c200/v3/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/faq/4849/
- https://www.tp-link.com/en/support/download/tapo-c100/v5/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/download/tapo-c100/v5/#Firmware-Release-Notes
- https://www.tp-link.com/en/support/download/tapo-c200/v3/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/download/tapo-c425/v1.20/#Firmware-Release-Notes
- https://www.tp-link.com/en/support/download/tapo-c425/v1.20/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes
- https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes
ADP enrichment
No English description supplied.
No references supplied.