Security2 hOctober 18, 2026, 19:01

TP-Link patches two RCE flaws in Tapo cameras and TL-WR841N router

TP-Link's October 2026 batch covers two command-execution flaws: CVE-2026-102369 (CVSS 8.7) in Tapo C120 V1 and C200 V5 cameras, reachable from the local network without credentials, and CVE-2026-102294 (CVSS 8.5) in the TL-WR841N V14, which requires an authenticated admin session. Fixes ship as builds 1.9.4, 1.4.6 and 4.19; no active exploitation has been reported.

DEV Community

Open source

TP-Link patches two RCE flaws in Tapo cameras and TL-WR841N router

CVE-2026-102369: CVSS 8.7, Tapo C120 V1 and C200 V5, unauthenticated LAN attack
CVE-2026-102294: CVSS 8.5, TL-WR841N V14, injection via IPv6 Gateway value
Patches: 1.9.4 Build 260813, 1.4.6 Build 260709, 4.19 Build 260821/260820
No public PoC or reports of active exploitation

#TP-Link#Tapo#Archer

TP-Link Archer 8 Ultra: first Wi-Fi 8 router at £669.99

Security

Zero-Day Flaw in TP-Link Cameras Enables Eavesdropping

Gadgets

TP-Link Tapo Doorbell Pro D260 Review: 4K and Local Storage Without a Subscription

Gadgets

TP-Link patches two RCE flaws in Tapo cameras and TL-WR841N router

TP-Link Archer 8 Ultra: first Wi-Fi 8 router at £669.99

Zero-Day Flaw in TP-Link Cameras Enables Eavesdropping

TP-Link Tapo Doorbell Pro D260 Review: 4K and Local Storage Without a Subscription

TP-Link’s New 4K Video Doorbell Sounds Like an All-Seeing, Subscription-Free Dream