Two TP-Link flaws enable OS command execution on Tapo cameras and TL-WR841N router

TP-Link released a set of security advisories on October 1, 2026 covering seven vulnerabilities across five devices: the Tapo C120 and C200 cameras, the Archer AX90 and Deco M9 Plus routers, and the TL-WR841N router. According to an analysis published on dev.to, which draws on a SecurityOnline report and TP-Link's own advisories, two of the seven allow operating system command execution. Although they reach the same end state, they get there by very different routes, and that difference changes how defenders should respond.

Two flaws, two different paths

The first, CVE-2026-102369, affects the Tapo C120 V1 and C200 V5 and carries a CVSS 4.0 score of 8.7. As the dev.to analysis explains, it is a chain rather than a single bug. The camera guards its login challenge data poorly, which lets an attacker on the local network replay captured login material. A MacTool handler then runs commands based on input supplied by the attacker without proper sanitization. The only precondition is network adjacency — no valid credentials are needed — and that combination is what pushes the score to 8.7.

The second, CVE-2026-102294, affects the TL-WR841N V14 and scores 8.5. It is a direct injection: the router's configuration interface accepts a crafted IPv6 Gateway value and feeds it into a system command. There is no authentication bypass here; the attacker must already hold an authenticated administrator session, and that requirement is what keeps the score at 8.5 despite the identical outcome.

The analysis frames the contrast succinctly: one flaw is an authentication failure that escalates into command execution, the other an input validation failure sitting behind a legitimate login.

What command execution means on each device

Both flaws result in arbitrary command execution on the device itself, meaning control of the whole device rather than a single service running on it. On the cameras, the dev.to analysis notes, that exposes stored configuration, network credentials and any integrations the camera holds, and converts an inexpensive appliance into a foothold inside the network. On the router, command execution means control of routing and name resolution for every device behind it, along with the ability to establish persistence beyond the web interface.

Fixed firmware versions

The analysis lists the following fixed builds, which are specific to each model and hardware revision:

• Tapo C120 V1: 1.9.4 Build 260813
• Tapo C200 V5: 1.4.6 Build 260709
• TL-WR841N V14: 4.19 Build 260821 for the English build, or 4.19 Build 260820 for the US build

After updating, the analysis recommends verifying the resulting build string on each device.

Exposure and exploitation status

No active exploitation has been reported for either flaw, and no public proof-of-concept has been confirmed. ZoomEye queries cited in the analysis returned 61,480 observations for the Tapo, Archer and Deco product families by title, and 196 for Tapo alone, while a query scoped to CVE-2026-102369 returned zero — expected, the analysis notes, for a disclosure this recent. Those figures describe the visible population of the product families, not the count of vulnerable devices, and the TL-WR841N is not represented by the family-title query at all.

Mitigations differ by precondition

Because the preconditions differ, so do the effective controls. For the camera flaw, credential hygiene accomplishes nothing, since the bug is reachable without authentication. The practical measures are putting the cameras on a separate network segment away from ordinary client devices and limiting which hosts can reach them. For the router flaw, credentials matter directly: replace default administrator passwords, restrict who holds administrator access, and keep the management interface off the WAN.

Where both device types share a network, the analysis advises applying both sets of controls rather than picking one. A segmented network with weak router credentials still leaves the TL-WR841N path open, and strong credentials do not close the unauthenticated camera path.

Why it matters

Consumer routers and cameras are among the most widely deployed and least maintained devices on home and small-office networks, and this batch shows two of them shipping flaws that hand over full device control. The pair is also a useful reminder that near-identical CVSS scores — 8.7 versus 8.5 — can conceal completely different attack preconditions, and that those preconditions, not the score, determine the right defensive moves. Anyone running the affected Tapo cameras or a TL-WR841N V14 should apply the model-specific firmware now and check that the build string matches the fixed versions.