TP-Link Tapo C200: Two Zero-Days Allow Video Feed Access for Adjacent Attackers

OPSWAT has disclosed two zero-day vulnerabilities in the TP-Link Tapo C200 camera that compromise the local authentication mechanism. An attacker with adjacent network access can obtain administrative privileges without knowing the password, accessing live video streams and stored recordings. The vendor released firmware V5_1.4.6 on August 18, 2026, but a third critical vulnerability remains under coordinated disclosure.

How the Bypass Works: A Challenge-Response That Nullifies Itself

The vulnerable mechanism resides in the local HTTPS management service on port 443. In a proper challenge-response protocol, the server generates a random value, the client encrypts it with the user's password, and returns the result. Verification compares the response against the server's expected calculation.

In the Tapo C200, the server accepts as valid a response that simply replays the original challenge unchanged, without requiring any derivation from the administrator's password. This failure breaks the fundamental property of the mechanism: the response must prove knowledge of the password, not merely the ability to echo the received value.

OPSWAT documented the technique in a proof-of-concept video recorded under controlled laboratory conditions. The exploit requires no credentials or user interaction: the attacker captures the challenge, forwards it unaltered, and obtains an administrative session.

What You Expose: Not Just the Live Stream, but the Recorded History

Administrative access obtained via CVE-2026-15315 goes far beyond a glance at the real-time feed. According to OPSWAT, "the resulting administrative access enables the attacker to invoke privileged management functions, modify device configuration and perform operations that would normally require authorized administrator access."

The privacy risk is concrete: Tapo C200 cameras are widely deployed in homes and small offices for baby monitoring, pet surveillance, and SOHO security. OPSWAT specifies that "this access may also expose privacy-sensitive camera functionality, including live video streams and stored recordings, enabling unauthorized surveillance of footage captured by the affected device."

The attack vector requires adjacent network access (AV:A in the CVSS 4.0 vector). For most home users with a standard NAT-protected network, this limits the risk of exploitation from the internet. The attack surface expands in scenarios with active port forwarding on port 443, already-compromised Wi-Fi networks, or the presence of attackers with local network access.

The Second Flaw: DoS During Wi-Fi Onboarding

CVE-2026-15316 affects the device's initial configuration phase. An attacker with network access can send a deliberately oversized encrypted credential value to the camera's HTTPS service during onboarding, causing it to crash.

The NVD record for this vulnerability is incomplete in the available material. OPSWAT describes the impact as limited to availability: the attack during onboarding prevents device configuration. It is unknown whether the crash forces a rollback to previous conditions or reopens the surface for other vulnerabilities.

The Third Shadow: A Critical Issue Still Sealed

The OPSWAT dossier mentions a third critical vulnerability that remains under coordinated disclosure with TP-Link. The source describes it as potentially allowing full camera compromise and use of the device as a foothold on the local network.

The exact technical nature of the flaw is unknown. Dahvid Schloss, COO of Suzu Labs, hypothesized a possible command injection or memory safety profile, but this reading is not confirmed by OPSWAT or official documentation. The lack of disclosure prevents assessment of temporary mitigations or the complexity of a potential exploit.

"If someone's made it that far into your network, they're not after the baby monitor" — Dahvid Schloss, COO Suzu Labs

What to Do Now

• Verify that the firmware on your Tapo C200 v5 or C120 v1 camera is updated to version V5_1.4.6 Build 260709 Rel.27675n, released August 18, 2026.
• Remove any port forwarding rules pointing to port 443 on the cameras.
• Isolate IoT cameras in a VLAN or segmented network, limiting adjacent access to unauthorized devices.
• Monitor router logs for suspicious connections to the cameras' port 443.

Why These Flaws Deserve Attention Beyond the Single Device

The persistence of a basic authentication bypass on a modern TP-Link product has drawn comment from the security community. Dahvid Schloss observed: "That attack chain isn't uncommon on cheap, older consumer IoT devices where security wasn't top of mind, but if that's the case here, seeing it hold up on a modern TP-Link device would be a bit of a blast from the past."

TP-Link manages its coordinated disclosure program through its own security advisory [5248]. The advisory confirms the program's existence but provides no additional technical details beyond the OPSWAT documentation.

Frequently Asked Questions

Are the vulnerabilities remotely exploitable?

No. The CVSS 4.0 vector indicates AV:A (Attack Vector: Adjacent), which requires adjacent network access. The flaws cannot be exploited from the internet without prior compromise of the local network or active port forwarding configurations.

Does firmware V5_1.4.6 also fix the third vulnerability?

It is unknown whether firmware V5_1.4.6 addresses the third flaw. The vulnerability remains under coordinated disclosure and OPSWAT has not disclosed details on any partial or complete fixes.

How many devices are at risk?

The specified affected products are the Tapo C200 v5 with firmware prior to V5_1.4.6 Build 260709 Rel.27675n and the Tapo C120 v1 with firmware prior to 1.9.3 Build 260521. The exact number of unpatched devices is not available.

Source Limitations

This article is based primarily on the OPSWAT advisory and the NVD record for CVE-2026-15315. TP-Link has not released a detailed public advisory beyond confirming the disclosure program [5248]. The NVD record for CVE-2026-15316 is incomplete in the available material. Dahvid Schloss's impact analyses represent expert assessments, not confirmations from the vendor or the researcher who discovered the vulnerabilities.

Sources: OPSWAT (original advisory), NVD (CVE-2026-15315 record), Infosecurity Magazine (reporting with quotes), TP-Link (disclosure program [5248])