The vulnerability arises from an absent authentication check in the HTTPS onboarding scan feature of the TP‑Link Tapo C120 v1 and Tapo C200 v5 devices. An attacker who can reach the device over the local network can trigger a scan request and receive a list of nearby wireless access points, including SSIDs, BSSIDs, authentication and encryption modes, and signal‑strength details. This reveals the local wireless topology without any credentials, allowing reconnaissance or facilitation of further attacks.

TP‑Link Systems Inc.’s Tapo C120 v1 and Tapo C200 v5 devices are the only versions affected, as specified in the firmware release notes.

The vulnerability carries a CVSS score of 5.3, indicating moderate severity. No EPSS data is available, and it is not listed in CISA’s KEV catalog. Because the flaw requires only local network presence and no authentication, an attacker with LAN access can exploit it by sending an HTTPS request to invoke the onboarding scan. The attack vector is local network exploitation, limited to devices with the affected firmware.