Administrative access via device_confirm replay

Authentication bypass in TP-Link Tapo C200 v5 before V5_1.4.6 allows adjacent attackers to gain administrative sessions via device_confirm replay. The login authentication verification module inadequately validates challenge parameters and accepts a replayed device_confirm value, issuing an administrative session token without proving knowledge of valid credentials. Exploitation requires local-network reachability to the camera management interface; the resulting admin session can be used for privileged management actions and temporary service interruption.