TP-Link Tapo C200 v3 allocation of resources

Summaryinfo

A vulnerability identified as critical has been detected in TP-Link Tapo C200 v3. This issue affects some unknown processing. The manipulation leads to allocation of resources. This vulnerability is uniquely identified as CVE-2026-12760. The attack can only be initiated within the local network. No exploit exists.

Detailsinfo

A vulnerability was found in TP-Link Tapo C200 v3 (affected version not known) and classified as critical. This issue affects some unknown functionality. The manipulation with an unknown input leads to a allocation of resources vulnerability. Using CWE to declare the problem leads to CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. Impacted is availability. The summary by CVE is:

A denial-of-service (DoS) vulnerability has been identified in Tapo C200 v3 in the network packet handling logic due to improper handling of IPv4 fragmented packets.  An unauthenticated adjacent attacker can send crafted packets to cause excessive resource consumption, leading to instability of the device.Successful exploitation can remotely trigger a temporary denial-of-service condition, causing the camera to become unresponsive and resulting in intermittent loss of video monitoring and recording.

The weakness was disclosed by Arjan Chadha. It is possible to read the advisory at tp-link.com. The identification of this vulnerability is CVE-2026-12760 since 06/19/2026. The exploitation is known to be easy. The attack can only be initiated within the local network. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• TP-Link

Name

• Tapo C200 v3

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion