Threat database

Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, an unauthenticated attacker on the same local network can invoke the scan action and retrieve nearby wireless access-point metadata, including SSIDs, BSSIDs, authentication and encryption modes, and signal-strength information. Successful exploitation may disclose information about the wireless environment surrounding the camera, allowing an attacker to learn elements of the local wireless topology.

Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser.  The interface is reachable without authentication after initial setup and does not validate that a password field is present for certain authentication and encryption parameter combinations, allowing a malformed request from the same local network to crash the HTTPS service  Successful exploitation may temporarily make HTTPS management functions unavailable. Repeated malformed requests may sustain the denial-of-service condition, and recovery may in some cases require a device reboot.

TP-Link TL-WR841N version 14 contains an authenticated OS command injection vulnerability in its IPv6 WAN configuration. An authenticated administrator can exploit this flaw by providing a crafted IPv6 Gateway value that is improperly handled in a system command. This may lead to arbitrary command execution on the device, potentially allowing unauthorized access to sensitive information, modification of device settings, or disruption of device operation.

CVE-2026-84941 is an information disclosure vulnerability in the SAML Single Sign-On (SSO) feature of TP-Link Omada Software Controller for Windows. It affects versions from 0 up to but not including 6.2.14.11, including version 0. The flaw arises from insufficient validation of user-supplied SAML metadata by authenticated users with SAML configuration privileges, potentially allowing unauthorized access to sensitive information. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.9. No known exploits are reported in the wild, and no official patch or remediation details are provided in the input data.

An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation may lead to complete device compromise, including unauthorized command execution, modification of device settings, and loss of confidentiality, integrity, and availability

An authenticated directory traversal vulnerability in file upload functionality has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8. Due to insufficient validation of user-supplied file information, an authenticated remote attacker with access to the affected upload functionality could upload a specially crafted file and cause it to be written outside the intended directory. Successful exploitation could allow an authenticated remote attacker to write files to unintended locations, potentially overwriting or modifying files accessible to the affected service; arbitrary code execution has not been demonstrated.

A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8 due to improper access control; a remote unauthenticated attacker may be able to access and modify VPN configuration information without valid credentials. Successful exploitation may allow a remote unauthenticated attacker to disclose and modify VPN configuration information.

A stack-based buffer overflow vulnerability exists in the httpd component of RE210 AC750 due to improper bounds checking in the splitString function when processing an uploaded configuration file. An authenticated attacker on the local network can upload a crafted configuration file to trigger the overflow, leading to remote code execution. Successful exploitation may allow unauthorized access to sensitive information, modification of device configuration and network behavior, or disruption of device availability.

An information disclosure vulnerability has been identified in Omada Controller.  An API endpoint intended for Controller initialization remains accessible after completion and may disclose account-related information to unauthenticated remote users.  Successful exploitation may allow an attacker to remote query the affected endpoint that may facilitate user enumeration and subsequent attacks targeting administrative accounts.

A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution on the device. Successful exploitation may cause the EasyMesh daemon to crash and may potentially allow remote code execution when Mesh mode is enabled. This may result in high impact to the confidentiality, integrity, and availability of the affected device.

A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private key to decrypt the administrator password; the weakened AES session key further reduces the effort required to compromise session confidentiality. Successful exploitation may disclose the administrator password captured from an HTTP login session and compromise session confidentiality.

A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An adjacent unauthenticated attacker with access to the router's web management interface can trigger memory corruption and potentially achieve arbitrary code execution. Successful exploitation can overwrite saved control-flow data on the httpd process stack prior to authentication, resulting in a service crash or potential arbitrary code execution in the context of the affected process.

CVE-2026-76651 is a buffer overflow vulnerability in the embedded HTTP service of TP-Link TL-WR841N v14. It occurs when processing multipart/form-data requests due to insufficient validation of an attacker-controlled boundary parameter. This can lead to memory corruption by overwriting data beyond an internal buffer. While arbitrary code execution, information disclosure, and denial-of-service have not been demonstrated, the vulnerability may cause undefined application behavior.

CVE-2026-76650 is a NULL pointer dereference vulnerability in the UPnP service of TP-Link TL-WR841N v14. It occurs when processing SOAP state variable query requests, potentially causing the UPnP service process to terminate unexpectedly or become unstable. Exploitation results in a denial-of-service condition affecting UPnP discovery and management functions until the process is restarted or the device rebooted. The vulnerability has a medium severity rating with a CVSS score of 5.3. No patch or official remediation guidance is currently available.

CVE-2026-76649 is a NULL pointer dereference vulnerability in the UPnP service of TP-Link System Inc.'s TL-WR841N v14 router. It occurs when processing specially crafted SOAP action requests containing unexpected XML content, causing the UPnP daemon to terminate unexpectedly. Successful exploitation results in a denial-of-service condition affecting UPnP functionality until the service is restarted or the device is rebooted. The vulnerability has a medium severity with a CVSS score of 5.3. No patch or official remediation information is currently available.

TP-Link Kasa smart home devices HS103P3 and HS103P4 v5 have insufficient cryptographic protections in their local communication protocol. This weakness allows an adjacent network attacker to intercept, replay, or forge control messages. Exploitation can lead to unauthorized control of the device, causing state changes, disruption, or denial of service.