The vulnerability originates from inadequate protection of login challenge data and insufficient sanitization of input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay the captured login challenge to gain an administrative session, then enable a privileged service that becomes available after a reboot. Once enabled, the attacker can submit crafted input to the MacTool process, allowing them to execute arbitrary commands within the device management system. This results in full compromise of confidentiality, integrity, and availability for the affected camera.

The flaw affects TP‑Link Systems Inc. Tapo C120 version 1 and Tapo C200 version 5. Firmware releases v1.26 for the C120 and v5 for the C200 contain the vendor‑issued fix.

The CVSS score of 8.7 indicates high severity. While EPSS data is unavailable, the exploit requires only local‑network presence, replay of login challenge data, activation of the privileged service, and a device reboot. Because an attacker need not authenticate, the risk to any camera on an unsecured local network is significant, yet the attack surface is limited to devices exposed to local traffic. The feature is not listed in CISA KEV, though the impact would be severe if exploited.