TL;DR
Get business pricing on tools and workshop supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TP-Link has released firmware updates for its Tapo C200 and C120 cameras after researchers reported vulnerabilities that could allow an attacker on the same network to gain administrator access. A separate denial-of-service flaw affects the C200. Owners should install the latest firmware; the reported attacks require prior access to the home network or another trusted network.
TP-Link has released firmware updates for its Tapo C200 and C120 cameras after researchers found a login flaw that could let someone already on the same network gain administrator access. The vulnerability could expose live video, recordings and camera settings; a separate flaw can disrupt the C200’s HTTPS service or restart the device.
Security firm OPSWAT identified two vulnerabilities in the Tapo C200 series, according to The Ambient’s report. The more serious, CVE-2026-15315, has a reported severity score of 8.7 and affects the C200 and the C120’s V1 hardware version, according to TP-Link’s advisory as described in the report.
OPSWAT researchers Khoi Tran and Thai Do found the login bypass in the cameras’ HTTPS management interface. The report says a second verification path accepts a value supplied by the camera during login as an authentication response. A small number of requests can then create an administrator session without a password or an existing session. With that access, an attacker could view live video and stored recordings or change camera settings.
The second issue, CVE-2026-15316, has a reported score of 7.1 and affects the C200 alone. According to the report, sending an oversized portion of encrypted Wi-Fi credential data can crash the camera’s HTTPS service or cause the device to restart. TP-Link has issued updates addressing both vulnerabilities; owners need to install the latest firmware on each affected camera.
Network Access Can Expose Camera Feeds
The login bypass matters because it could turn access to a household’s local network into access to a camera’s video, recordings and controls. That may be particularly sensitive when a camera is used as a baby monitor. OPSWAT’s researchers said such access could expose live video, night vision, crying detection and two-way audio.
The scope described in the report is limited by an important condition: an attacker must already be on the same Wi-Fi network or within a trusted ecosystem. That is different from a flaw that allows remote access to any camera over the internet. It does not remove the risk for households where an unauthorised person or compromised device has gained network access, but the source material does not establish that these flaws have been used in attacks.
The C200’s second vulnerability presents a different concern. It does not describe unauthorised viewing; rather, it could interrupt the camera’s service or trigger a restart. Installing the vendor’s updates addresses the reported issues, while also reducing the chance that vulnerable firmware remains in use.
As an affiliate, we earn on qualifying purchases.
Two Flaws, Different Camera Risks
The report distinguishes between a login bypass affecting two models and a separate service-disruption flaw limited to the C200. CVE-2026-15315 applies to the C200 and, in TP-Link’s advisory, the V1 hardware version of the C120. CVE-2026-15316 applies only to the C200.
Both reported attacks require the attacker to have access to the same Wi-Fi network or another trusted environment first. OPSWAT researchers reported the findings, and TP-Link issued firmware updates for both models. The source report does not provide firmware version numbers or a detailed release timeline, so owners should check the camera’s update options or TP-Link’s support information for the applicable version.
““live video, night vision, crying detection and two-way audio””
— OPSWAT researchers Khoi Tran and Thai Do, as quoted in The Ambient report
Exploit Activity and Patch Versions
The available report does not say whether attackers have exploited either vulnerability, how many devices may remain unpatched, or whether the flaws were used outside security testing. It also does not give the firmware version numbers, the exact dates the updates became available, or a full account of TP-Link’s response beyond the issuance of fixes.
The C120 impact is described specifically for its V1 hardware version; the report does not establish whether other hardware revisions are affected. The same-network requirement is reported for both attacks, but the material does not detail every possible route by which an attacker could gain that access. These points should not be treated as evidence that other models or attack conditions are affected.
Owners Should Check Camera Firmware
Owners of Tapo C200 and C120 cameras should check for and install the latest firmware available for their specific model and hardware version. The update is the stated fix for the login bypass on affected models and for the C200 crash vulnerability. If automatic updates are available, owners can check that the camera has received the current release rather than assume an update has been applied.
TP-Link’s advisory and support pages are the relevant sources for model-specific update instructions and version details. Further information would be needed to establish the exact release timeline, the number of cameras still running vulnerable firmware, and whether any exploitation has occurred.
Key Questions
Which Tapo cameras are affected?
The login bypass, CVE-2026-15315, affects the Tapo C200 and the V1 hardware version of the Tapo C120 listed in TP-Link’s advisory. The separate CVE-2026-15316 issue affects the C200 alone.
Could someone access a camera from anywhere on the internet?
The report says the described attacks require the attacker to be on the same Wi-Fi network or within a trusted ecosystem. It does not describe the login bypass as an attack that works against any camera remotely over the internet.
What could the login bypass allow?
According to the report, successful exploitation could create an administrator session without a password or existing session, allowing access to live video, saved recordings and camera settings.
What should camera owners do?
Install the latest firmware for the camera’s model and hardware version. The source report does not provide version numbers, so owners should consult the camera’s update settings or TP-Link support information.
Source: rss
Halloween Picks
halloween
As an affiliate, we earn on qualifying purchases.
