Vulnerability Intelligence Report
TP-LINK Tapo C200 remote code execution vulnerability
CVE-2021-4045
TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root. The exploitation of this vulnerability allows an attacker to take full control of the camera.
No Active Exploit Signals
CVSS Base Score
9.8
CRITICAL
Exploitability:3.9
Impact Score:5.9
EPSS Probability:72.84%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-77 ↗CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| TP-Link | Tapo C200 | 1.15 <= 1.15 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
72.843%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | Spanish National Cybersecurity Institute, S.A. (INCIBE) · CERT · Spain |
| Reserved | 2021-12-02T00:00:00 |
| Published | 2022-03-07T21:58:20 |
| Patch Date | 2022-02-11 |
| Last Updated | 2024-09-17T02:57:31 |
Community Chatter & Buzz