CVE-2026-12760: TP-Link Tapo C200 v3 IPv4 Fragmentation DoS Vulnerability

Technical summary

CVE-2026-12760 is a denial-of-service vulnerability in TP-Link Tapo C200 v3 stemming from improper handling of IPv4 fragmented packets (CWE-770: Allocation of Resources Without Limits or Throttling). The vulnerability resides in the network packet handling logic. When an unauthenticated attacker sends crafted fragmented packets to an adjacent network location, the device fails to properly throttle or validate resource consumption during reassembly, leading to memory exhaustion or CPU overload. This causes the camera to become unresponsive, resulting in temporary loss of availability. The CVSS 3.1 score of 6.5 (MEDIUM) reflects the attack vector requiring network adjacency and no authentication, but no confidentiality or integrity impact—only availability is degraded.

Business impact

Organizations relying on Tapo C200 v3 cameras for continuous surveillance or security monitoring face intermittent outages of video feeds without warning or direct user action. An attacker with local network access can disrupt monitoring capabilities at will, potentially creating blind spots during critical periods. For deployments in sensitive environments, this availability loss poses operational and security risks. The temporary nature of the DoS means repeated attacks could create a pattern of unreliability, undermining confidence in the monitoring infrastructure.

Affected systems

TP-Link Tapo C200 v3 firmware is confirmed affected. The vulnerability advisory should be consulted to determine if other Tapo C200 firmware versions or related Tapo models share the same flaw, as the source data lists the product multiple times. Organizations should verify their exact firmware version and device variant against TP-Link's official advisory to confirm exposure.

Exploitability

Exploitation requires the attacker to be on the same local network as the device (adjacent network access) and does not require authentication or user interaction. Crafting the malicious fragmented packets requires minimal technical skill once the attack principle is understood. The ease of triggering the DoS and the accessibility of the attack surface make this practical for an adversary within network range. However, the attacker cannot achieve code execution, data theft, or persistence—only temporary disruption.

Remediation

TP-Link has released or is releasing a firmware patch addressing the improper handling of IPv4 fragmented packets. Organizations should verify the patch version and availability from TP-Link's official support channels. In parallel, network segmentation and access controls can limit which hosts can reach the camera, reducing the pool of potential attackers. For high-availability deployments, implementing camera redundancy and network monitoring to detect anomalous packet patterns can help mitigate the availability impact.

Patch guidance

Consult TP-Link's official advisory for the corrected firmware version applicable to your Tapo C200 v3 device. Verify the firmware build number before and after patching to ensure successful application. If automatic update is available through the Tapo app or device settings, enable it; otherwise, manual firmware upload may be required. Test the patched device under normal operating conditions to confirm stability. Prioritize patching for cameras deployed in critical monitoring locations or sensitive networks.

Detection guidance

Monitor for alerts from intrusion detection systems (IDS) or network monitoring tools that flag unusual fragmented IPv4 traffic directed at camera IP addresses. Watch for sudden, unexplained unavailability of specific camera feeds, particularly if availability recovers after a short period without intervention. Correlate such events with network traffic logs to identify sources of fragmented packets. Log camera uptime and responsiveness metrics to establish baselines and detect patterns of intermittent outages that may indicate exploitation attempts.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), prioritization should account for the device's role in your environment. Cameras deployed in secure facilities, perimeter monitoring, or compliance-critical areas warrant higher urgency. The low barrier to exploitation (adjacent network access, no authentication) and the lack of active user action required mean that any adversary with network reach can trigger the DoS. Organizations with flat network architectures or guest Wi-Fi networks bridged to IoT devices face elevated risk.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a MEDIUM severity: the attack vector is adjacent (AV:A), not remote; the attack complexity is low (AC:L); no privileges or user interaction are required (PR:N, UI:N); and the impact is scoped to the device itself (S:U) with availability completely compromised (A:H) but no confidentiality or integrity loss. The score appropriately penalizes the attack requirement for network adjacency while recognizing that availability loss in a security camera is a notable operational concern.

Frequently asked questions