CVE-2023-27126 Hardcoded credentials in n/a
An attacker with physical access can extract hardcoded keys to decrypt Wi-Fi passwords and TP-Link account credentials from the camera.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-27126?
CVE-2023-27126 is a medium-severity vulnerability in n/a, published on 6 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused across all cameras. An attacker with physical access to a camera is able to extract and decrypt sensitive data containing the Wifi password and the TP-LINK account credential of the victim.
Weakness: CWE-522
Which versions are affected by CVE-2023-27126?
It affects 1 product.
Products include Tp-Link Tapo C200 Firmware.
How do I fix CVE-2023-27126?
No fix has been published for CVE-2023-27126 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-27126 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-27126 exists.
Other vulnerabilities in n/a
- CVE-2021-4045 TP-LINK Tapo C200 remote code execution vulnerability
- CVE-2025-14300 Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425
- CVE-2025-8065 Remote Code Execution via Stack-based Buffer Overflow in ONVIF SOAP Parser in TP-Link Tapo C200 and C520WS
- CVE-2026-15316 Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200
- CVE-2026-12760 Denial-of-Service Vulnerability via Malformed IPv4 Fragmentation Handling in TP-Link Tapo C200
Sources
Also known as GHSA-jg46-gm9c-xj3p.