CVE-2026-12760 Denial-of-Service Vulnerability via Malformed IPv4 Fragmentation Handling in TP-Link Tapo C200
An unauthenticated adjacent attacker can cause a temporary denial-of-service condition in TP-Link Tapo C200 cameras by sending malformed IPv4 fragmented packets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-12760?
CVE-2026-12760 is a high-severity denial of service vulnerability in TP-Link Systems Inc. Tapo C200 v3, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A denial-of-service (DoS) vulnerability has been identified in Tapo C200 v3 in the network packet handling logic due to improper handling of IPv4 fragmented packets. An unauthenticated adjacent attacker can send crafted packets to cause excessive resource consumption, leading to instability of the device.Successful exploitation can remotely trigger a temporary denial-of-service condition, causing the camera to become unresponsive and resulting in intermittent loss of video monitoring and recording.
Weakness: CWE-770
Which versions are affected by CVE-2026-12760?
It affects 1 product.
Products include Tp-Link Tapo C200 Firmware.
How do I fix CVE-2026-12760?
No fix has been published for CVE-2026-12760 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-12760 being exploited?
There is no known exploitation of CVE-2026-12760 in the wild and no public exploit code.
Other vulnerabilities in TP-Link Systems Inc. Tapo C200 v3
- CVE-2021-4045 TP-LINK Tapo C200 remote code execution vulnerability
- CVE-2025-14300 Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425
- CVE-2025-8065 Remote Code Execution via Stack-based Buffer Overflow in ONVIF SOAP Parser in TP-Link Tapo C200 and C520WS
- CVE-2026-15316 Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200
- CVE-2026-1871 Authenticated Stack-based Buffer Overflow in RTSP Authentication of Tapo C200
Sources
Also known as GHSA-25hh-rw6j-95ch.