CVE-2026-102369 in Tapo C120
Summary
by MITRE • 10/01/2026
Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service that becomes accessible after a reboot, and submit crafted input to execute arbitrary commands within the device management process.
Successful exploitation may allow arbitrary command execution on the camera and compromise the confidentiality, integrity, and availability of the affected device. Exploitation requires access from the same local network, replay of the login challenge data, activation of the privileged service, and a device reboot.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The Tapo C120 v1 and C200 V5 security cameras suffer from critical authentication bypass and command injection vulnerabilities that stem from inadequate protection of login challenge data and insufficient sanitization of user input within the MacTool handler. These flaws allow an unauthenticated attacker operating on the same local network to compromise the device's administrative access controls. The core issue lies in the failure to properly validate or bind session tokens, enabling attackers to intercept and replay valid authentication challenges. This lack of cryptographic binding between the challenge and the specific client session allows for straightforward replay attacks that bypass standard login mechanisms without requiring prior credentials.
The exploitation process involves several distinct steps that leverage these weaknesses. First, an attacker captures a legitimate login challenge from the network traffic. By replaying this captured data to the device's authentication endpoint, the attacker can successfully obtain an administrative session token. This initial access grants the ability to interact with higher-level management functions that are typically restricted to authorized users. Following successful authentication, the attacker can enable a privileged service on the camera. This specific service is designed to remain active or become accessible after a system reboot, providing persistent access even if the device is restarted for maintenance or power cycles.
Once administrative privileges and the persistent service are established, the vulnerability escalates from an authentication bypass to remote code execution. The MacTool handler processes attacker-controlled input without adequate sanitization, allowing for command injection attacks. An adversary can submit crafted inputs that exploit this lack of validation, resulting in the arbitrary execution of system commands within the context of the device management process. This capability effectively grants full control over the camera's operating environment, enabling the installation of malware, modification of configuration files, or use of the device as a pivot point for further network attacks.
The operational impact of these vulnerabilities is severe, compromising the confidentiality, integrity, and availability of the affected devices. Confidentiality is breached as attackers can access video feeds and stored data without authorization. Integrity is compromised through the ability to alter firmware settings or inject malicious code into system processes. Availability is threatened by the potential for denial-of-service conditions created through arbitrary command execution or resource exhaustion via the privileged service. The requirement for local network access limits the attack surface to internal threats, such as those originating from compromised endpoints on the same subnet or insider attacks, but does not mitigate the severity of the resulting compromise once that initial foothold is gained.
From a classification perspective, these vulnerabilities align with CWE-287 Improper Authentication and CWE-94 Command Injection: Improper Control of Generation of Code (Code Injection). The authentication bypass mechanism reflects weaknesses in session management and challenge-response validation, while the command injection aspect highlights failures in input validation within system handlers. In terms of offensive security frameworks, these exploits map to ATT&CK techniques including T1078 Valid Accounts for initial access via credential replay and T1059 Command and Scripting Interpreter for lateral movement or persistence through arbitrary code execution. The ability to enable services that persist after reboot also relates to persistence mechanisms often seen in advanced persistent threat campaigns targeting IoT devices.
Mitigation strategies must address both the authentication flaws and the input validation gaps. Manufacturers should implement strict binding of session tokens to specific client identifiers, such as IP addresses or MAC addresses, to prevent replay attacks across different sessions or clients. Additionally, challenge-response protocols must utilize nonces that are unique per request and time-bound to ensure they cannot be reused. For the command injection vulnerability, rigorous input sanitization is required in the MacTool handler, ensuring that all user-supplied data is validated against a whitelist of allowed characters and commands before processing. Network segmentation can also serve as a compensating control by isolating IoT devices from critical network segments, thereby limiting the potential blast radius if an attacker gains local access. Regular firmware updates implementing these fixes are essential to restore the security posture of affected Tapo camera models.