A TP-Link Internet Camera Contains a Serious Flaw, Security Researchers Say

Security researchers have discovered some vulnerabilities in TP-Link’s Tapo C200, an indoor surveillance camera, including a “critical” flaw that the company is still working to patch. The critical vulnerability can “allow an attacker to fully compromise the camera and use the compromised device as a foothold within the network,” according to researchers at the US cybersecurity vendor OPSWAT. OPSWAT didn’t reveal more details, such as whether exploiting the vulnerability requires local access to the camera's internet network. But the cybersecurity firm says it continues “to work closely with TP-Link on validation and remediation” of the flaw. The Tapo C200 is an affordable internet camera sold at retailers, including Amazon, that can be used as a baby or pet monitor, enabling a customer to see the live footage over the mobile app. However, OPSWAT’s researchers examined the product’s firmware and local communication processes and discovered two other software-related vulnerabilities in the camera —one of which could be used for spying. That said, the spying flaw requires the hacker to have already obtained local access to the owner’s internet network. The vulnerability, dubbed CVE-2026-15315, can let an attacker “obtain a valid admin session without the password,” by exploiting an alternative authentication path, OPSWAT says. “Once authenticated, the attacker gains access to management functionality normally restricted to the camera administrator, allowing unauthorized changes to the device's configuration and other privileged operations,” the company added. Meanwhile, the second flaw, CVE-2026-15316, can be used to knock the camera offline. “An attacker can send oversized crypted ciphertext values that may trigger exception handling failures, due to insufficient validation, causing the affected device to crash or restart,” the official vulnerability description says . But again, the flaw requires local network access to the camera. TP-Link didn’t immediately respond to a request for . But the company patched the two flaws last month by releasing a new firmware build for the Tapo C200 that users can download and update to. The flaws also affect another camera, the Tapo C120, which has received updated firmware as well. Installing the new firmware can be done through the Tapo mobile app. UPDATE: TP-Link told PCMag that the company "takes the security of our products and the privacy of our customers very seriously. Upon being notified by independent security researchers of vulnerabilities affecting certain smart products, specifically Tapo C200 camera, our product security team immediately investigated the findings and developed firmware updates to address the reported issues." "The affected vulnerabilities have been remediated for Tapo C200 V5. We strongly encourage all customers to ensure their devices are running the latest firmware version, available through the Tapo app," the company added. "TP-Link is committed to responsible vulnerability disclosure and continues to work closely with the research community to review and address reported security findings."

The critical vulnerability can “allow an attacker to fully compromise the camera and use the compromised device as a foothold within the network,” according to researchers at the US cybersecurity vendor OPSWAT. OPSWAT didn’t reveal more details, such as whether exploiting the vulnerability requires local access to the camera's internet network. But the cybersecurity firm says it continues “to work closely with TP-Link on validation and remediation” of the flaw. The Tapo C200 is an affordable internet camera sold at retailers, including Amazon, that can be used as a baby or pet monitor, enabling a customer to see the live footage over the mobile app. However, OPSWAT’s researchers examined the product’s firmware and local communication processes and discovered two other software-related vulnerabilities in the camera —one of which could be used for spying. That said, the spying flaw requires the hacker to have already obtained local access to the owner’s internet network. The vulnerability, dubbed CVE-2026-15315, can let an attacker “obtain a valid admin session without the password,” by exploiting an alternative authentication path, OPSWAT says. “Once authenticated, the attacker gains access to management functionality normally restricted to the camera administrator, allowing unauthorized changes to the device's configuration and other privileged operations,” the company added. Meanwhile, the second flaw, CVE-2026-15316, can be used to knock the camera offline. “An attacker can send oversized crypted ciphertext values that may trigger exception handling failures, due to insufficient validation, causing the affected device to crash or restart,” the official vulnerability description says . But again, the flaw requires local network access to the camera. TP-Link didn’t immediately respond to a request for . But the company patched the two flaws last month by releasing a new firmware build for the Tapo C200 that users can download and update to. The flaws also affect another camera, the Tapo C120, which has received updated firmware as well. Installing the new firmware can be done through the Tapo mobile app. UPDATE: TP-Link told PCMag that the company "takes the security of our products and the privacy of our customers very seriously. Upon being notified by independent security researchers of vulnerabilities affecting certain smart products, specifically Tapo C200 camera, our product security team immediately investigated the findings and developed firmware updates to address the reported issues." "The affected vulnerabilities have been remediated for Tapo C200 V5. We strongly encourage all customers to ensure their devices are running the latest firmware version, available through the Tapo app," the company added. "TP-Link is committed to responsible vulnerability disclosure and continues to work closely with the research community to review and address reported security findings."

OPSWAT didn’t reveal more details, such as whether exploiting the vulnerability requires local access to the camera's internet network. But the cybersecurity firm says it continues “to work closely with TP-Link on validation and remediation” of the flaw. The Tapo C200 is an affordable internet camera sold at retailers, including Amazon, that can be used as a baby or pet monitor, enabling a customer to see the live footage over the mobile app. However, OPSWAT’s researchers examined the product’s firmware and local communication processes and discovered two other software-related vulnerabilities in the camera —one of which could be used for spying. That said, the spying flaw requires the hacker to have already obtained local access to the owner’s internet network. The vulnerability, dubbed CVE-2026-15315, can let an attacker “obtain a valid admin session without the password,” by exploiting an alternative authentication path, OPSWAT says. “Once authenticated, the attacker gains access to management functionality normally restricted to the camera administrator, allowing unauthorized changes to the device's configuration and other privileged operations,” the company added. Meanwhile, the second flaw, CVE-2026-15316, can be used to knock the camera offline. “An attacker can send oversized crypted ciphertext values that may trigger exception handling failures, due to insufficient validation, causing the affected device to crash or restart,” the official vulnerability description says . But again, the flaw requires local network access to the camera. TP-Link didn’t immediately respond to a request for . But the company patched the two flaws last month by releasing a new firmware build for the Tapo C200 that users can download and update to. The flaws also affect another camera, the Tapo C120, which has received updated firmware as well. Installing the new firmware can be done through the Tapo mobile app. UPDATE: TP-Link told PCMag that the company "takes the security of our products and the privacy of our customers very seriously. Upon being notified by independent security researchers of vulnerabilities affecting certain smart products, specifically Tapo C200 camera, our product security team immediately investigated the findings and developed firmware updates to address the reported issues." "The affected vulnerabilities have been remediated for Tapo C200 V5. We strongly encourage all customers to ensure their devices are running the latest firmware version, available through the Tapo app," the company added. "TP-Link is committed to responsible vulnerability disclosure and continues to work closely with the research community to review and address reported security findings."

However, OPSWAT’s researchers examined the product’s firmware and local communication processes and discovered two other software-related vulnerabilities in the camera —one of which could be used for spying. That said, the spying flaw requires the hacker to have already obtained local access to the owner’s internet network. The vulnerability, dubbed CVE-2026-15315, can let an attacker “obtain a valid admin session without the password,” by exploiting an alternative authentication path, OPSWAT says. “Once authenticated, the attacker gains access to management functionality normally restricted to the camera administrator, allowing unauthorized changes to the device's configuration and other privileged operations,” the company added. Meanwhile, the second flaw, CVE-2026-15316, can be used to knock the camera offline. “An attacker can send oversized crypted ciphertext values that may trigger exception handling failures, due to insufficient validation, causing the affected device to crash or restart,” the official vulnerability description says . But again, the flaw requires local network access to the camera. TP-Link didn’t immediately respond to a request for . But the company patched the two flaws last month by releasing a new firmware build for the Tapo C200 that users can download and update to. The flaws also affect another camera, the Tapo C120, which has received updated firmware as well. Installing the new firmware can be done through the Tapo mobile app. UPDATE: TP-Link told PCMag that the company "takes the security of our products and the privacy of our customers very seriously. Upon being notified by independent security researchers of vulnerabilities affecting certain smart products, specifically Tapo C200 camera, our product security team immediately investigated the findings and developed firmware updates to address the reported issues." "The affected vulnerabilities have been remediated for Tapo C200 V5. We strongly encourage all customers to ensure their devices are running the latest firmware version, available through the Tapo app," the company added. "TP-Link is committed to responsible vulnerability disclosure and continues to work closely with the research community to review and address reported security findings."

That said, the spying flaw requires the hacker to have already obtained local access to the owner’s internet network. The vulnerability, dubbed CVE-2026-15315, can let an attacker “obtain a valid admin session without the password,” by exploiting an alternative authentication path, OPSWAT says. “Once authenticated, the attacker gains access to management functionality normally restricted to the camera administrator, allowing unauthorized changes to the device's configuration and other privileged operations,” the company added. Meanwhile, the second flaw, CVE-2026-15316, can be used to knock the camera offline. “An attacker can send oversized crypted ciphertext values that may trigger exception handling failures, due to insufficient validation, causing the affected device to crash or restart,” the official vulnerability description says . But again, the flaw requires local network access to the camera. TP-Link didn’t immediately respond to a request for . But the company patched the two flaws last month by releasing a new firmware build for the Tapo C200 that users can download and update to. The flaws also affect another camera, the Tapo C120, which has received updated firmware as well. Installing the new firmware can be done through the Tapo mobile app. UPDATE: TP-Link told PCMag that the company "takes the security of our products and the privacy of our customers very seriously. Upon being notified by independent security researchers of vulnerabilities affecting certain smart products, specifically Tapo C200 camera, our product security team immediately investigated the findings and developed firmware updates to address the reported issues." "The affected vulnerabilities have been remediated for Tapo C200 V5. We strongly encourage all customers to ensure their devices are running the latest firmware version, available through the Tapo app," the company added. "TP-Link is committed to responsible vulnerability disclosure and continues to work closely with the research community to review and address reported security findings."

“Once authenticated, the attacker gains access to management functionality normally restricted to the camera administrator, allowing unauthorized changes to the device's configuration and other privileged operations,” the company added. Meanwhile, the second flaw, CVE-2026-15316, can be used to knock the camera offline. “An attacker can send oversized crypted ciphertext values that may trigger exception handling failures, due to insufficient validation, causing the affected device to crash or restart,” the official vulnerability description says . But again, the flaw requires local network access to the camera. TP-Link didn’t immediately respond to a request for . But the company patched the two flaws last month by releasing a new firmware build for the Tapo C200 that users can download and update to. The flaws also affect another camera, the Tapo C120, which has received updated firmware as well. Installing the new firmware can be done through the Tapo mobile app. UPDATE: TP-Link told PCMag that the company "takes the security of our products and the privacy of our customers very seriously. Upon being notified by independent security researchers of vulnerabilities affecting certain smart products, specifically Tapo C200 camera, our product security team immediately investigated the findings and developed firmware updates to address the reported issues." "The affected vulnerabilities have been remediated for Tapo C200 V5. We strongly encourage all customers to ensure their devices are running the latest firmware version, available through the Tapo app," the company added. "TP-Link is committed to responsible vulnerability disclosure and continues to work closely with the research community to review and address reported security findings."

Meanwhile, the second flaw, CVE-2026-15316, can be used to knock the camera offline. “An attacker can send oversized crypted ciphertext values that may trigger exception handling failures, due to insufficient validation, causing the affected device to crash or restart,” the official vulnerability description says . But again, the flaw requires local network access to the camera. TP-Link didn’t immediately respond to a request for . But the company patched the two flaws last month by releasing a new firmware build for the Tapo C200 that users can download and update to. The flaws also affect another camera, the Tapo C120, which has received updated firmware as well. Installing the new firmware can be done through the Tapo mobile app. UPDATE: TP-Link told PCMag that the company "takes the security of our products and the privacy of our customers very seriously. Upon being notified by independent security researchers of vulnerabilities affecting certain smart products, specifically Tapo C200 camera, our product security team immediately investigated the findings and developed firmware updates to address the reported issues." "The affected vulnerabilities have been remediated for Tapo C200 V5. We strongly encourage all customers to ensure their devices are running the latest firmware version, available through the Tapo app," the company added. "TP-Link is committed to responsible vulnerability disclosure and continues to work closely with the research community to review and address reported security findings."

TP-Link didn’t immediately respond to a request for . But the company patched the two flaws last month by releasing a new firmware build for the Tapo C200 that users can download and update to. The flaws also affect another camera, the Tapo C120, which has received updated firmware as well. Installing the new firmware can be done through the Tapo mobile app. UPDATE: TP-Link told PCMag that the company "takes the security of our products and the privacy of our customers very seriously. Upon being notified by independent security researchers of vulnerabilities affecting certain smart products, specifically Tapo C200 camera, our product security team immediately investigated the findings and developed firmware updates to address the reported issues." "The affected vulnerabilities have been remediated for Tapo C200 V5. We strongly encourage all customers to ensure their devices are running the latest firmware version, available through the Tapo app," the company added. "TP-Link is committed to responsible vulnerability disclosure and continues to work closely with the research community to review and address reported security findings."

UPDATE: TP-Link told PCMag that the company "takes the security of our products and the privacy of our customers very seriously. Upon being notified by independent security researchers of vulnerabilities affecting certain smart products, specifically Tapo C200 camera, our product security team immediately investigated the findings and developed firmware updates to address the reported issues." "The affected vulnerabilities have been remediated for Tapo C200 V5. We strongly encourage all customers to ensure their devices are running the latest firmware version, available through the Tapo app," the company added. "TP-Link is committed to responsible vulnerability disclosure and continues to work closely with the research community to review and address reported security findings."

"The affected vulnerabilities have been remediated for Tapo C200 V5. We strongly encourage all customers to ensure their devices are running the latest firmware version, available through the Tapo app," the company added. "TP-Link is committed to responsible vulnerability disclosure and continues to work closely with the research community to review and address reported security findings."