Security researchers have discovered serious flaws in TP-Link Tapo C200 cameras. Attackers could exploit one Tapo C200 vulnerability to gain administrator access and watch live footage without knowing the owner’s password.
Researchers Discover Three Camera Flaws
Researchers at infrastructure security company OPSWAT uncovered three vulnerabilities in the popular indoor camera.
Consumers commonly use the Tapo C200 for home security, pet monitoring and baby monitoring. Some businesses also use the device inside their premises.
Two of the flaws carry high-severity ratings and now have public identifiers. Researchers have withheld details about a potentially more serious third vulnerability while TP-Link prepares appropriate protections.
A compromised camera could expose private video and audio. Moreover, attackers may use the device as an entry point for attacks against other systems on the same network.
Authentication Bypass Grants Administrator Access
The first vulnerability, CVE-2026-15315, allows an attacker with network access to bypass the camera’s login system.
The Tapo C200 uses a challenge-response process to verify that someone attempting to sign in knows the password. However, researchers found that attackers could replay previously transmitted information.
The camera may incorrectly accept that reused data as valid authentication. Therefore, an attacker could gain administrator privileges without learning the owner’s password.
Once an attacker establishes a network path to the camera, exploitation requires only a small number of malicious requests. According to OPSWAT, the attack could take just a few minutes.
Successful exploitation may provide access to live video and stored recordings. An intruder could also change settings and use administrator-only features.
Attackers Could Access Night Vision and Audio
The privacy risks become particularly serious when owners use the camera as a baby monitor.
An attacker with administrative access could potentially watch the live feed, including footage captured through night vision. The intruder may also access crying detection and two-way audio features.
As a result, an attacker might not only listen inside the home but also speak through the camera.
The same capabilities could expose private conversations, household routines and information about when residents are away. Access to stored recordings may reveal additional sensitive details.
Undisclosed Flaw Could Enable Network Attacks
OPSWAT also found another vulnerability that may allow attackers to take complete control of the camera.
Researchers believe an attacker could then use the compromised device to target other equipment on the same local network. This would turn the camera into a foothold for a broader intrusion.
However, OPSWAT has not released technical details about this flaw. The company is coordinating with TP-Link to verify the issue and develop a fix.
Researchers plan to share more information after appropriate protections become available.
Second Disclosed Bug Can Crash the Camera
The other disclosed vulnerability, CVE-2026-15316, affects configuration data that the camera processes during setup.
This high-severity flaw requires authentication. An attacker on the network can send large amounts of deliberately crafted traffic to the device.
The traffic can crash the camera’s management service. Consequently, the camera may go offline and lock out its legitimate owner until the service recovers.
Such an attack could temporarily disable monitoring at a critical moment. It may also prevent the owner from changing settings or accessing the device.
Graduate researcher Khoi Tran discovered all three flaws in a laboratory. Thai Do supervised the research as part of an OPSWAT graduate programme.
TP-Link Releases Updated Firmware
TP-Link released new firmware and a security advisory on August 18. The two publicly disclosed vulnerabilities affect Tapo C200 cameras using firmware released before that update.
Users should install the latest firmware immediately. They should also avoid exposing cameras directly to the internet and protect their Wi-Fi networks with strong security settings.
Businesses should place cameras on isolated networks whenever possible. In addition, administrators should limit access to authorised users and devices.
The Tapo C200 vulnerability findings follow earlier security issues affecting other TP-Link products. Researchers disclosed critical flaws in several Archer NX routers in March. Those bugs could allow attackers to bypass authentication and perform privileged operations.
0 responses to “Tapo C200 Vulnerability Exposes Private Camera Feeds”