TP-Link has published four security advisories covering seven vulnerabilities in specific Tapo cameras, an Archer router, a Deco mesh system and a TL-WR841N router. The fixes are firmware updates for the listed hardware revisions. Check your exact model, hardware version and region, then install the matching build from TP-Link’s support site. The Tapo advisory also contains a mismatch between a CVE number in its title and the number used in its body; that identifier remains unresolved in the advisory.
Which TP-Link devices are affected?
The advisories apply to these specific hardware revisions, not automatically to every device with the same model name. TP-Link’s Product Security Trust Center lists the advisories as updated October 1, 2026. TP-Link Product Security Trust Center
As an Amazon Associate I earn from qualifying purchases.
| Device and affected revision | Vulnerability or vulnerabilities | Attacker position or access | TP-Link CVSS 4.0 score | Listed fixed firmware |
|---|---|---|---|---|
| Tapo C120 V1 and Tapo C200 V5 | Four entries: CVE-2026-9032, CVE-2026-78577 in the advisory body (CVE-2026-78579 in its title), CVE-2026-78578 and CVE-2026-102369 | Unauthenticated access from the same local network | 7.1, 5.3, 7.1 and 8.7, respectively | C120 V1_1.9.4 Build 260813 Rel.79754n; C200 V5_1.4.6 Build 260709 Rel.27675n |
| Archer AX90 V1 | CVE-2026-84682 | Unauthenticated adjacent-network attacker | 7.7 | 1.1.4 Build 20260927 |
| Deco M9 Plus V2 | CVE-2026-8618 | Unauthenticated adjacent-network attacker | 7.7 | 1.9.2 Build 20260818 |
| TL-WR841N v14 | CVE-2026-102294 | Authenticated administrator | 8.5 | 4.19 Build 260821 (EN); 4.19 Build 260820 (US) |
These CVSS 4.0 scores are those TP-Link published in its 2026 advisories. A score alone does not tell you whether an attacker can reach a device: the network-position and authentication requirements in the table are important qualifications. Archer AX90 advisory · Deco M9 Plus advisory · Tapo advisory · TL-WR841N advisory
What can the vulnerabilities allow?
Tapo C120 and C200: service disruption, disclosure and command execution
TP-Link describes four issues affecting the listed camera revisions. CVE-2026-9032 is a NULL pointer dereference that can crash the HTTPS service after initial setup. Repeated requests may prolong the denial of service, and recovery may require a reboot. Another issue exposes wireless-environment information during onboarding scans; TP-Link calls it CVE-2026-78577 in the advisory body but CVE-2026-78579 in the title. CVE-2026-78578 can allow unauthenticated Wi-Fi reconfiguration, potentially disconnecting a camera from its intended network.
#1 Best Overall
- ENDLESS POWER FROM SOLAR ENERGY: Just 45 minutes of direct sunlight powers the camera for a full day of use, while the built-in battery lasts up to 180 days on a single charge during cloudy days. Solar charging requires temperatures above 32°F.△
- EASY WIRE-FREE INSTALLATION: Place the Tapo SolarCam C402 KIT where you need it without relying on nearby outlets. Install the camera and solar panel together or separately using the included 13 ft cable for flexible placement.
- PRIORITIZE WHAT MATTERS: Set activity zones to monitor specific areas for motion or people. Free person and motion detection helps reduce unwanted alerts and notifies you when activity is detected.
- VERSATILE VIDEO STORAGE: Store footage locally via a microSD card (up to 512GB)* or via cloud with a Tapo Care cloud subscription. Tailor your security to suit your needs, whether indoor or outdoor, you have the storage option you need.
- FULL-COLOR 1080P, DAY AND NIGHT: See clearly in low light with a large-aperture lens and built-in spotlights. Capture full-color night vision up to 30 ft away to monitor for possible intruders or motion.
The fourth issue, CVE-2026-102369, is command injection. TP-Link says exploitation requires local-network access, replaying login challenge data, activating a privileged service and rebooting the device. Successful exploitation may allow arbitrary command execution and compromise confidentiality, integrity and availability. The advisory does not resolve the CVE-number discrepancy for the onboarding information-disclosure issue, so do not assume either identifier is definitive without confirmation from TP-Link. TP-Link Tapo C120/C200 advisory
Archer AX90: root command execution during boot
CVE-2026-84682 affects the TDDPv2 setProductVer command in /usr/bin/tddp on Archer AX90 V1. TP-Link says an unauthenticated attacker on an adjacent network may execute operating-system commands as root during device boot, potentially compromising the router. TP-Link Archer AX90 advisory
Rank #2
- 【2K High Definition】Capture every detail inside your home with crystal-clear 2K high definition video with this indoor security camera. Easily see what your baby is holding or what your pet is playing with.Controller Type:Amazon Alexa;Android;Google Assistant.Connectivity protocol:Wi-Fi.Power source type:Corded Electric, Power Adapter: 100–240 V. Connects via 2.4GHz Wi-Fi Band
- 【Up, Down, All Around】This Pan/Tilt camera see everything across an entire room or walkway with the 360° horizontal and 114° vertical range pan/tilt field of view.
- 【Detection & Instant Notification】Get instant push notifications when motion, person or baby crying is detected, there is no additional fee to use it as a baby camera monitor. Discern from notifications that matter, so you'll know if its your pet playing around or if someone is actually there.
- 【Works w/ Alexa & Google Assistant】Fully compatible with Amazon Alexa and Google Assistant, use your simple voice command to view Tapo indoor security camera live stream on Echo Show or Google Chrome Cast with a screen. Streaming via Google limited to display on Chromecast & Nest devices only.
- 【2-Way Audio w/ Built In Siren】Never truly leave home with the built-in 2-way audio. Use as a pet camera with phone app to comfort your pet from anywhere in the world. Keep your family safe with cameras for home security indoor by warding off intruders.
Deco M9 Plus: buffer overflow during setup
CVE-2026-8618 is a stack-based buffer overflow in the TDDPv2 subtype 0x91 handler on Deco M9 Plus V2. According to TP-Link, the device does not sufficiently validate a decrypted request’s length before copying it into a fixed-size stack buffer. An unauthenticated adjacent-network attacker may be able to cause a denial of service or achieve arbitrary code execution during device setup. TP-Link Deco M9 Plus advisory
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11TL-WR841N: command injection through IPv6 WAN configuration
CVE-2026-102294 affects IPv6 WAN configuration on TL-WR841N v14. TP-Link says a crafted IPv6 Gateway value is incorporated into a system command, allowing an authenticated administrator to execute commands. Listed potential impacts include accessing sensitive information, changing configuration or services, and disrupting operation. TP-Link TL-WR841N advisory
Rank #3
- 【Endless Power from Solar Energy】Just 45 minutes of direct sunlight powers the camera for a full day of use, while the built-in battery lasts up to 180 days on a single charge during cloudy days. Solar charging requires temperatures above 32°F.△
- 【Easy Wire-Free Installation - Install Anywhere】Enjoy the flexibility of wire-free installation with the Tapo SolarCam C402 KIT. Free from outlet limitations, you can effortlessly set up the camera and solar panel wherever you need—whether it's the front porch, backyard, garage, or even a remote shed. The innovative design allows for the camera and solar panel to be installed as a unified unit or separately using the included 13-foot cable, providing optimal placement for any scenario.
- 【Prioritize What Matters】Eliminate unnecessary notifications by defining activity zones specifically monitoring for motion or people. Receive real-time alerts for true security concerns with free person/motion detection, eliminating false detection from other objects.
- 【Versatile Video Storage】Store footage locally via a microSD card (up to 512GB)* or via cloud with a Tapo Care cloud subscription. Tailor your security to suit your needs, whether indoor or outdoor, you have the storage option you need.
- 【Full-Color 1080P, Day and Night】Achieve crystal-clear visibility even in complete darkness, thanks to the large aperture lens and built-in spotlights. Capture vibrant color night vision up to 30ft away for enhanced security to monitor for possible intruders or motion.
How to check your device and install the fix
- Identify the exact model and hardware revision. Check the label on the device and its management interface, then compare it with the affected revision in TP-Link’s advisory. A model-family match alone is not enough.
- Open TP-Link’s support page for that exact model and region. Confirm that the hardware revision and regional variant match your device before downloading firmware. For the TL-WR841N, for example, the listed 4.19 builds differ between EN and US.
- Check the installed firmware version. Use the device’s administration interface or the Tapo/Deco app where applicable; menu names vary by product and firmware. Compare the installed version with the exact fixed build listed in the advisory.
- Install the matching vendor firmware and allow the update to finish. Follow TP-Link’s model-specific instructions. Do not interrupt power during installation or install a build intended for a different hardware revision or region.
- Verify the update. After the device restarts, check its firmware information again and confirm it reports the listed fixed build or a later TP-Link release for the same hardware and region.
The firmware builds listed by TP-Link are C120 V1_1.9.4 Build 260813 Rel.79754n, C200 V5_1.4.6 Build 260709 Rel.27675n, Archer AX90 V1 1.1.4 Build 20260927, Deco M9 Plus V2 1.9.2 Build 20260818, and TL-WR841N v14 4.19 Build 260821 (EN) or 4.19 Build 260820 (US). Use TP-Link’s support page to confirm availability and compatibility for your region before installing.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What “unauthenticated” means in these advisories
It does not mean the vulnerable service is necessarily exposed to anyone on the internet. TP-Link specifies same-local-network access for the Tapo issues and adjacent-network positioning for Archer AX90 and Deco M9 Plus. The TL-WR841N command-injection issue requires an authenticated administrator. These are the access conditions stated in the advisories; they should not be generalized into claims about remote internet exposure.
Quick Recap
Best Value
- 2K HIGH DEFINITION: Capture every detail inside your home with crystal-clear 2K high definition video with this indoor security camera. Easily see what your baby is holding or what your pet is playing with. 2.4 GHz Wi-Fi required.
- SEE MORE WITH PAN/TILT: This Pan/Tilt IP camera see everything across an entire room or walkway with the 360° horizontal and 114° vertical range pan/tilt field of view.
- NO SUBSCRIPTION STORAGE OPTION - Store recordings on a microSD card at no cost◇ (up to 512GB) or subscribe to Tapo Care's cloud storage.
- DETECTION & INSTANT NOTIFICATIONS: Get instant push notifications when motion, a person, or a baby crying is detected. No additional fee is required for baby monitoring. Smart detection helps distinguish pets from people.
- WORKS W/ ALEXA & GOOGLE ASSISTANT: Use voice commands to view your Tapo camera’s live stream on Echo Show, Chromecast, or Nest displays. Google streaming is limited to Chromecast and Nest devices.
Rank #4
- 2024 PCMag Editor's Choice - Praised for its outstanding value, delivering sharp 2K resolution and a comprehensive feature set.
- Compact, Versatile, Weatherproof - The Tapo C120 is a compact camera suitable for indoor and outdoor use, featuring an IP66 rating for withstanding rain, dust, and rugged conditions.
- Magnetic Base for Flexible Mounting - Easily attach the C120 camera to any metal surface with its magnetic base. Versatile mounting on railings, frames, or even the refrigerator.
- 2K QHD 4MP Resolution - Crystal-clear detail in every shot. Capture every moment with stunning 2K quality that ensures even the finest details are never missed.
- Starlight Color Night Vision - The built-in Starlight sensor delivers bright, colorful video at night, with two spotlights for extra illumination in darker conditions.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
