{"id":"CVE-2026-15315","aliases":["EUVD-2026-62193","GHSA-xw5g-644p-8357"],"status":"published","title":"Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200","description":"Tapo C120 v1 and C200 v5\ncontain an improper authentication vulnerability within the login\nauthentication verification module. An attacker on the local network can\nexploit weaknesses in challenge parameter validation to bypass normal\nauthentication controls and obtain administrative session tokens. \n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow an attacker to subsequently execute privileged\nmanagement actions, enable unauthorized administrative access and temporary\ndisruption of device services, resulting in a denial-of-service (DoS)\ncondition.","severity":{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00462,"percentile":0.40396,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-287"],"published":"2026-08-18T21:24:59Z","modified":"2026-09-04T18:32:18Z","exploits":[{"source":"pocgithub","id":"HORKimhab/CVE-2026-15315","title":"HORKimhab/CVE-2026-15315","date":"2026-09-15","url":"https://github.com/HORKimhab/CVE-2026-15315"}],"products":[{"vendor":"tp-link","product":"tapo_c120_firmware"},{"vendor":"tp-link","product":"tapo_c200_firmware"},{"vendor":"tp-link systems inc","product":"tapo c120 v1"},{"vendor":"tp-link systems inc.","product":"tapo c200 v5"}],"references":[{"url":"https://www.tp-link.com/us/support/download/tapo-c200/v5/","tags":["patch","Product","Release Notes"]},{"url":"https://www.tp-link.com/en/support/download/tapo-c200/v5/","tags":["patch","Product","Release Notes"]},{"url":"https://www.tp-link.com/us/support/faq/5248/","tags":["vendor-advisory","Vendor Advisory","Patch"]},{"url":"https://www.tp-link.com/us/support/download/tapo-c120/v1.26/#Firmware-Release-Notes","tags":["patch","Release Notes","Product"]},{"url":"https://www.tp-link.com/en/support/download/tapo-c120/v1.26/#Firmware-Release-Notes","tags":["patch","Release Notes","Product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15315"},{"url":"https://www.tp-link.com/en/support/download/tapo-c200/v5"},{"url":"https://www.tp-link.com/us/support/download/tapo-c200/v5"},{"url":"https://www.tp-link.com/us/support/faq/5248"},{"url":"https://github.com/advisories/GHSA-xw5g-644p-8357"}],"sources":{"cve":[{"id":"CVE-2026-15315","title":"Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200","description":"Tapo C120 v1 and C200 v5\ncontain an improper authentication vulnerability within the login\nauthentication verification module. An attacker on the local network can\nexploit weaknesses in challenge parameter validation to bypass normal\nauthentication controls and obtain administrative session tokens. \n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow an attacker to subsequently execute privileged\nmanagement actions, enable unauthorized administrative access and temporary\ndisruption of device services, resulting in a denial-of-service (DoS)\ncondition.","status":"published","published":"2026-08-18T21:24:59.428Z","modified":"2026-08-27T23:08:42.298Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:47:51.033687Z"}],"euvd":[{"id":"EUVD-2026-62193","description":"Tapo C120 v1 and C200 v5\ncontain an improper authentication vulnerability within the login\nauthentication verification module. An attacker on the local network can\nexploit weaknesses in challenge parameter validation to bypass normal\nauthentication controls and obtain administrative session tokens. \n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow an attacker to subsequently execute privileged\nmanagement actions, enable unauthorized administrative access and temporary\ndisruption of device services, resulting in a denial-of-service (DoS)\ncondition.","status":"published","published":"2026-08-18T21:24:59Z","modified":"2026-08-27T23:08:42Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:24.093932Z"}],"ghsa":[{"id":"GHSA-xw5g-644p-8357","title":"Tapo C200 v5\ncontains an improper authentication vulnerability within the login\nauthentication...","description":"Tapo C200 v5\ncontains an improper authentication vulnerability within the login\nauthentication verification module. An attacker on the local network can\nexploit weaknesses in challenge parameter validation to bypass normal\nauthentication controls and obtain administrative session tokens. \n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow an attacker to subsequently execute privileged\nmanagement actions, enable unauthorized administrative access and temporary\ndisruption of device services, resulting in a denial-of-service (DoS)\ncondition.","status":"published","published":"2026-08-19T00:31:09Z","modified":"2026-09-04T18:32:18Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:11:23.738212Z"}],"nvd":[{"id":"CVE-2026-15315","description":"Tapo C120 v1 and C200 v5\ncontain an improper authentication vulnerability within the login\nauthentication verification module. An attacker on the local network can\nexploit weaknesses in challenge parameter validation to bypass normal\nauthentication controls and obtain administrative session tokens. \n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may allow an attacker to subsequently execute privileged\nmanagement actions, enable unauthorized administrative access and temporary\ndisruption of device services, resulting in a denial-of-service (DoS)\ncondition.","status":"published","published":"2026-08-18T22:16:49.207Z","modified":"2026-09-04T17:39:06.83Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:39.620837Z"}]}}