{"id":"CVE-2021-4045","published":"2022-03-07T21:58:20Z","modified":"2024-09-17T02:57:31Z","title":"TP-LINK Tapo C200 remote code execution vulnerability","vendor":"TP-Link","product":"Tapo C200","tier":"core","eol":null,"affectedVersions":[{"vendor":"TP-Link","product":"Tapo C200","versions":[">= 1.15, <= 1.15"]}],"description":{"text":"TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root. The exploitation of this vulnerability allows an attacker to take full control of the camera.","provenance":"source","from":"CVE.org"},"summary":{"text":"The TP-Link Tapo C200 IP camera contains an unauthenticated remote code execution flaw in its uhttpd binary, which runs by default as root, affecting firmware versions 1.1.15 and below. An attacker who can reach the camera over the network can exploit it without credentials or user interaction to gain full control of the device.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:11Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.72376,"percentile":0.99438,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2022-04-01","exploitedFirstSeen":"2022-04-01","ransomware":false,"evidence":[{"url":"https://www.fortinet.com/blog/threat-research/totolink-vulnerabilities-beastmode-mirai-campaign","date":"2022-04-01"},{"url":"https://unit42.paloaltonetworks.com/recent-exploits-network-security-trends/","date":"2022-08-19"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":9,"pulses":[{"name":"TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development","url":"https://otx.alienvault.com/pulse/6a589f83231e4cad61103a92","created":"2026-07-16"},{"name":"Inside an IoT Botnet Framework With LLM-Assisted Development","url":"https://otx.alienvault.com/pulse/6a585dd1af5d4dd0ee2a8178","created":"2026-07-16"},{"name":"Inside an IoT Botnet Framework With LLM-Assisted Development","url":"https://otx.alienvault.com/pulse/6a5775d49e35f9a04532b24d","created":"2026-07-15"},{"name":"EbeeJuly2026 Pt4","url":"https://otx.alienvault.com/pulse/6a5677c7f67012eb53d1811f","created":"2026-07-14"},{"name":"Network Security Trends: Recent Exploits and More","url":"https://otx.alienvault.com/pulse/63037a764f7474d9194f3365","created":"2022-08-22"},{"name":"Beastmode Botnet Targets Bugs in Totolink Routers and Other Vendors’ Routers to Conduct DDoS Campaign","url":"https://otx.alienvault.com/pulse/624b19bbb24c22603870b8b3","created":"2022-04-04"},{"name":"Fresh TOTOLINK Vulnerabilities Picked Up by Beastmode Mirai Campaign","url":"https://otx.alienvault.com/pulse/624b0d1d363997edbf999c32","created":"2022-04-04"},{"name":"Fresh TOTOLINK Vulnerabilities Picked Up by Beastmode Mirai Campaign","url":"https://otx.alienvault.com/pulse/624a97d45e3336da9dbb0c6d","created":"2022-04-04"},{"name":"Fresh TOTOLINK Vulnerabilities Picked Up by Beastmode Mirai Campaign","url":"https://otx.alienvault.com/pulse/62488a11e8eb2c7e6f1fc2a9","created":"2022-04-02"}],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"}],"references":[{"url":"https://www.incibe-cert.es/en/early-warning/security-advisories/tp-link-tapo-c200-remote-code-execution-vulnerability","tags":["x_refsource_CONFIRM"]},{"url":"http://packetstormsecurity.com/files/168472/TP-Link-Tapo-c200-1.1.15-Remote-Code-Execution.html","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-33942","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-33942","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":51017,"url":"https://www.exploit-db.com/exploits/51017","title":"TP-Link Tapo c200 1.1.15 - Remote Code Execution (RCE)","type":"webapps","platform":"hardware","date":"2022-09-23","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2022-09-23"},"pocGithub":{"count":5,"skipped":1,"earliest":"2021-11-15","earliestUrl":"https://github.com/hacefresko/CVE-2021-4045","repos":[{"name":"hacefresko/CVE-2021-4045","url":"https://github.com/hacefresko/CVE-2021-4045","stars":120,"created":"2021-11-15"},{"name":"0xbinder/CVE-2021-4045","url":"https://github.com/0xbinder/CVE-2021-4045","stars":9,"created":"2023-12-26"},{"name":"234329a423853/CVE-2021-4045","url":"https://github.com/234329a423853/CVE-2021-4045","stars":2,"created":"2025-12-11"},{"name":"jeffbezosispogg/CVE-2021-4045","url":"https://github.com/jeffbezosispogg/CVE-2021-4045","stars":1,"created":"2022-10-11"},{"name":"DorskFR/tapodate","url":"https://github.com/DorskFR/tapodate","stars":1,"created":"2025-03-30"}]},"first":{"date":"2021-11-15","source":"PoC-in-GitHub","url":"https://github.com/hacefresko/CVE-2021-4045"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/168472/TP-Link-Tapo-c200-1.1.15-Remote-Code-Execution.html"],"flow":[],"timeline":[{"date":"2021-11-15","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2022-09-23","url":"https://github.com/hacefresko/CVE-2021-4045","provenance":"source"},{"date":"2022-03-07","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-4045","provenance":"source"},{"date":"2022-04-01","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.fortinet.com/blog/threat-research/totolink-vulnerabilities-beastmode-mirai-campaign","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":69.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1674 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.89,"detail":"percentile 0.9944"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry; 1 NVD exploit link; 5 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":2.27,"detail":"9 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}