{"id":"CVE-2026-78577","published":"2026-10-01T18:17:27.850","lastModified":"2026-10-01T20:36:38.330","description":"Tapo C120 v1 and C200 V5\ncontain a vulnerability in the HTTPS onboarding scan function due to missing authentication.\nAfter initial setup, an unauthenticated attacker on the same local network can\ninvoke the scan action and retrieve nearby wireless access-point metadata,\nincluding SSIDs, BSSIDs, authentication and encryption modes, and\nsignal-strength information.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may disclose information about the wireless environment\nsurrounding the camera, allowing an attacker to learn elements of the local\nwireless topology.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://www.tp-link.com/en/support/download/tapo-c120/v1.26/#Firmware-Release-Notes","tags":[]},{"url":"https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes","tags":[]},{"url":"https://www.tp-link.com/us/support/download/tapo-c120/v1.26/#Firmware-Release-Notes","tags":[]},{"url":"https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes","tags":[]},{"url":"https://www.tp-link.com/us/support/faq/5321/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}