CVE-2021-4045: TP-Link Tapo C200 camera command injection in uhttpd allows unauthenticated RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable root RCE with a CVSS score of 9.8 and public exploit code makes this an urgent patching priority.

What it is

The TP-Link Tapo C200 IP camera, firmware 1.1.15 and below, contains a command injection flaw (CWE-77) in the uhttpd binary, which runs as root by default. Because the flaw is reachable without authentication, an attacker on the network can execute arbitrary commands and take full control of the device.

Impact

An attacker gains root-level code execution on the camera, allowing full device takeover, including access to video feeds, credentials and any data the camera can reach on the local network.

Attack surface

Reachable over the network via the camera's HTTP service (uhttpd); the CVSS vector shows PR:N and UI:N, so no authentication or user interaction is required. The attacker only needs network access to the device's web interface.

Exploitation

Not listed in CISA KEV, but EPSS is 0.72376 (99.4th percentile) and public exploit references are tagged Exploit, indicating working exploit code is publicly available.

What to do

• Update the Tapo C200 to firmware newer than 1.1.15 as soon as TP-Link provides it.
• If patching is not possible, isolate cameras on a dedicated VLAN or network segment with no access to trusted hosts.
• Block inbound access to the camera's HTTP management interface from untrusted networks and the internet.
• Replace end-of-support devices that no longer receive firmware updates.
• Monitor vendor advisories for a fixed firmware release and apply it promptly.

Detection

• Inspect uhttpd or camera HTTP logs for unusual request parameters containing shell metacharacters such as ;, |, $() or backticks.
• Alert on unexpected outbound connections or processes spawned by uhttpd on the camera or its network segment.
• Monitor for anomalous traffic from camera VLANs to internal hosts or the internet that does not match normal camera behavior.
• Use network IDS signatures for known Tapo C200 exploit traffic if available.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.