The vulnerability consists of an unauthenticated HTTPS endpoint named connectAP on the Tapo C100 and C200 devices. Without proper authentication, an attacker on the same local network can invoke the API to change the device’s Wi‑Fi configuration. The change can cause the device to disconnect from the network, effectively denying access to the smart‑home functionality. The flaw is identified as CWE‑306, a missing authentication weakness.

Affected devices are TP‑Link Tapo C100 v5 and TP‑Link Tapo C200 V3. Additional firmware versions may be impacted, but the current report does not list specific firmware revisions beyond the product model and nominal release. Information about the exact firmware build numbers that are vulnerable is not supplied.

The CVSS score of 8.7 places the weakness in the high range, and the EPSS score of less than 1% indicates that the likelihood of exploitation is low at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no known exploited instances. The attack vector is inferred to be local‑network based, as the exploit requires the attacker to be on the same LAN segment as the device. Once the endpoint is accessed, the attacker can modify Wi‑Fi settings and render the device unreachable, causing an outage for any services that rely on it.