by Kastro
Paper/Archive/CVE-2021-4045

CVE-2021-4045

TP-Link Tapo C200 — TP-LINK Tapo C200 remote code execution vulnerability

EPSS 72%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.4.994 × 2019.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root. The exploitation of this vulnerability allows an attacker to take full control of the camera.

Affected

ProductAffectedFixed inSource
Tapo C2001.15 – 1.15–CNA

Scores by source

INCIBE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refincibe-cert.es/en/early-warning/security-advisories/tp-link-tapo-c200-remote-code-execution-vulnerabilityrefpacketstormsecurity.com/files/168472/TP-Link-Tapo-c200-1.1.15-Remote-Code-Execution.html