TP-Link Tapo C200 V3 Unauthenticated Access to Wi-Fi Configuration API Endpoint

A vulnerability exists in the Tapo C200 V3 camera model, where the HTTPS service exposes a connectAP interface without proper authentication. This flaw allows an unauthenticated attacker on the same local network segment to exploit the vulnerability by modifying the device's Wi-Fi configuration. The exploitation of this vulnerability can lead to a loss of connectivity and cause a denial-of-service condition on the device.

Impact

Exploitation of this vulnerability allows for unauthorized modification of the device's Wi-Fi settings, causing a loss of network connectivity and creating a denial-of-service condition on the device.

Remediation

Users are advised to check for updates on the Tapo Mobile Application to address this vulnerability. The latest firmware version can be downloaded from the TP-Link website.