Tapo C120 v1 and C200 v5 have an improper authentication flaw in the login verification module. An attacker on the local network can exploit weaknesses in the challenge parameter validation within the device_confirm process to bypass authentication and acquire administrative session tokens. This enables the attacker to perform privileged management actions and can result in temporary service disruption, creating a denial‑of‑service condition.

TP‑Link Systems Inc. – Tapo C200 v5 firmware version 5 and Tapo C120 v1 are vulnerable; no other models or firmware versions are listed as affected.

The vulnerability has a CVSS score of 8.7, indicating high severity. EPSS is less than 1%, and it is not listed in CISA’s KEV catalog. The likely attack vector is an attacker on the local network, as the flaw requires the attacker to reach the device’s device_confirm interface. Successful exploitation grants administrative privileges, enabling arbitrary management actions and potential disruption of device services.