TL;DR
Get home appliances delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TP-Link has issued firmware updates for its Tapo C200 and C120 cameras after researchers found a flaw that could give someone on the same network administrator access. A separate vulnerability can crash or restart the C200. The supplied report says owners should install the latest firmware; the number of affected devices and any confirmed exploitation are not stated.
TP-Link has released firmware updates for its Tapo C200 and C120 cameras after researchers found a login flaw that could let someone already on the same network gain administrator access. The updates also address a separate issue that could disrupt the C200’s HTTPS service or restart the device.
Security firm OPSWAT identified two vulnerabilities in the cameras’ management interface, which runs over HTTPS. The more severe, CVE-2026-15315, is rated 8.7 and affects the C200 series and the C120’s V1 hardware version, according to the supplied report. Researchers Khoi Tran and Thai Do found that an alternate verification path accepted a value the camera provides during login as an authentication response.
With a small number of requests, an attacker could obtain an administrator session without a password or an existing session, the report says. That access could expose live video and stored recordings or allow configuration changes. OPSWAT researchers said a camera used as a baby monitor could also expose night vision, crying detection and two-way audio.
The second issue, CVE-2026-15316, is rated 7.1 and affects the C200 alone. The report says an oversized portion of encrypted Wi-Fi credential data could crash its HTTPS service or cause the device to restart until it recovers. TP-Link has issued firmware updates addressing both vulnerabilities. Owners need to install the latest version on each camera; the supplied material does not identify firmware version numbers.
The Risk Depends on Network Access
The login bypass concerns privacy and control: a person who can reach a vulnerable camera from the same network may be able to view footage, access recordings or alter settings. The potential sensitivity is higher in rooms where cameras monitor children or other private household activity.
The network requirement narrows the described exposure. The source says an attacker must already be on the same Wi-Fi network or within a trusted ecosystem, so it does not describe an attack that can be carried out by any internet user at random. However, access to a household or trusted network could still make the flaw relevant to camera owners. Installing the firmware update is the stated way to address the vulnerabilities.
Two Flaws Affect Different Models
The two vulnerabilities have different reported scope. CVE-2026-15315 affects the C200 series and the C120 V1 hardware version and enables the described authentication bypass. CVE-2026-15316 affects only the C200 and concerns service disruption through oversized encrypted Wi-Fi credential data.
OPSWAT researchers Khoi Tran and Thai Do reported the authentication issue, according to The Ambient’s account. TP-Link’s advisory is described as listing the C120’s V1 hardware version as affected. The report does not provide a full list of C200 hardware versions or firmware build numbers, so owners may need to consult the camera’s update interface or TP-Link’s support materials for model-specific details.
“live video, night vision, crying detection and two-way audio”
— OPSWAT researchers Khoi Tran and Thai Do, as quoted in The Ambient’s report
Exploitation and Update Details
The supplied report does not say whether either vulnerability has been exploited in real-world attacks, how many cameras may be affected, or when TP-Link released the firmware updates. It also does not give the updated firmware version numbers or say whether the patches install automatically. The reported C120 scope specifically names V1 hardware, while the supplied material does not clarify the affected C200 hardware revisions.
Owners Should Check Camera Firmware
Owners of the Tapo C200 and C120 should check for and install the latest firmware for each camera, following TP-Link’s instructions. C120 owners should confirm their hardware revision against the advisory, which the supplied report says lists V1 as affected. TP-Link’s support page or the camera app is the place to verify available versions and update status.
Further clarity would come from TP-Link publishing the affected firmware ranges and update versions, and from any subsequent reports on exploitation or patch deployment. The source material gives no date for a further advisory or other next milestone.
Key Questions
Which TP-Link Tapo cameras are named as affected?
The report names the Tapo C200 series and the Tapo C120 V1 hardware version for the login bypass. The separate crash vulnerability is reported to affect the C200 alone.
What could someone do with the login bypass?
According to the report, a person on the same network could obtain administrator access without a password or existing session. That could expose live video and recordings or allow configuration changes.
Can the flaw be exploited from anywhere on the internet?
The supplied report says the attacker must first be on the same Wi-Fi network or within a trusted ecosystem. It does not describe remote access by an arbitrary internet user.
What should camera owners do?
Install the latest firmware on each affected camera. The supplied material does not list the firmware version numbers, so check TP-Link’s support information or the camera app for the applicable update.
Is there evidence the vulnerabilities have been used in attacks?
The source material does not report confirmed exploitation. It also does not state how many devices are affected.
Source: rss
Fall Picks
fall essentials
As an affiliate, we earn on qualifying purchases.
