Vulnerability overview
The TP-Link batch published on October 1, 2026 contains seven vulnerabilities in the Tapo C120 and C200 cameras, the Archer AX90 and Deco M9 Plus routers and the TL-WR841N router. Two of them end in operating system command execution, and comparing them shows how different the routes to the same outcome can be.
CVE-2026-102369 affects the Tapo C120 V1 and C200 V5 and scores 8.7 on CVSS 4.0. CVE-2026-102294 affects the TL-WR841N V14 and scores 8.5. No active exploitation has been reported for either, and no public proof-of-concept has been confirmed.
Mechanism and exploitation conditions
The Tapo flaw is a chain. The device's protection of login challenge data is weak, which allows an attacker on the local network to replay captured login data, and a MacTool handler then processes attacker-supplied input without adequate sanitization and executes commands. The precondition is adjacency, and no valid credentials are required. That combination is what pushes the score to 8.7.
The TL-WR841N flaw is a direct injection. The router accepts a crafted IPv6 Gateway value through its configuration interface and passes that value into a system command. No credential bypass is involved: the attacker must already hold an authenticated administrator session. That precondition is what keeps the score at 8.5 despite the same end state.
One flaw is an authentication failure that escalates into command execution. The other is an input validation failure behind a legitimate login. They share an effect and nothing else.
Impact
Both flaws produce arbitrary command execution on the device, and in both cases that means control of the device rather than of a single service on it.
On the camera, command execution exposes stored configuration, network credentials and any integration the camera holds, and it turns an inexpensive appliance into an internal foothold. On the router, command execution means control of routing and name resolution for everything behind it, and the attacker can install persistence outside the web interface.
Affected products and scope
The Tapo C120 V1 is fixed at 1.9.4 Build 260813 and the C200 V5 at 1.4.6 Build 260709. The TL-WR841N V14 is fixed at 4.19 Build 260821 for the English build or 4.19 Build 260820 for the US build. Both fixes are model- and revision-specific.
Exposure context
A ZoomEye query for the three product families by title, (title="Tapo" || title="Archer" || title="Deco"), returned 61,480 matching observations, and a title="Tapo" query returned 196. A CVE-scoped query for CVE-2026-102369 returned 0, which is expected for a disclosure of this age. These figures describe the visible population of the product families, not the number of vulnerable devices, and the TL-WR841N is not represented by the family-title query at all.
Remediation and mitigations
Apply the model-specific firmware to each device and verify the resulting build string.
Beyond patching, the two preconditions call for different controls. For CVE-2026-102369, no credential control helps, because the flaw is reachable without authentication; the effective measures are segmenting the cameras away from general-purpose clients and reducing the set of hosts that can reach them. For CVE-2026-102294, credential hygiene is directly relevant: replace default administrator passwords, limit who holds administrator access and stop exposing the management interface to the WAN.
Where both models share a network, apply both controls rather than choosing one. A segmented network with weak router credentials still leaves the TL-WR841N path open, and strong credentials do not close the unauthenticated camera path.
References
- SecurityOnline vulnerability report, TP-Link vulnerabilities, October 2, 2026: https://securityonline.info/tp-link-vulnerabilities/
- TP-Link advisories for the Tapo C120 and C200 and for the TL-WR841N IPv6 issue, as referenced by that report.
Top comments (0)