Thai Do (Lio) and Khoi Tran (KayTii) from OPSWAT

Unauthenticated Onboarding Connect NULL Pointer Dereference Denial of Service Vulnerability in TP-Link Tapo C120 & C200

Unauthenticated Onboarding Scan Information Disclosure in TP-Link Tapo C120 & C200

Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200

Unauthenticated Remote Code Execution via MacTool Command Injection in TP-Link Tapo C120 & C200

Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200

Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200