Two zero-day vulnerabilities in TP-Link’s Tapo C200 smart cameras recently revealed serious security gaps enabling attackers on the same network to bypass login credentials or crash services. These flaws—CVE-2026-15315 and CVE-2026-15316—were patched in firmware version V5_1.4.6, released August 18, 2026. Users who haven’t updated remain at significant risk.
What Went Wrong
The first vulnerability, CVE-2026-15315, is an authentication bypass in the camera’s local HTTPS management interface. Although the Tapo C200 is meant to use a challenge-response protocol over port 443 to verify user identity, researchers found an alternate path that sidesteps the password requirement. Attackers able to replay a value generated by the device during authentication can gain full administrator access without ever knowing the password. No active session, account, or interaction is required. Such access lets a malicious actor alter settings, reconfigure networks, access live feeds, or view stored recordings.
The second issue, CVE-2026-15316, is a denial-of-service weakness in the camera’s Wi-Fi onboarding system. Specifically, it fails to validate the size of encrypted credentials before passing them to cryptographic and configuration routines. An unauthenticated attacker with network access could send oversized, malformed data to crash the HTTPS service. Until recovery, management and monitoring services become unavailable.
Who Discovered It & When Patch Landed
The vulnerabilities were uncovered by two researchers, Khoi Tran and Thai Do, as part of OPSWAT’s Critical Infrastructure Cybersecurity Graduate Fellowship. Investigation focused on firmware and local-communication code in lab settings. TP-Link was informed on April 16, 2026; it acknowledged the flaws by July 10 and assigned the CVE numbers on August 13. The fixes were bundled into firmware V5_1.4.6, made available on August 18.
Why It Matters & What You Should Do
The Tapo C200 is a commonly used home and small business camera with features like cloud support, app-integration, and local management. These features expand its attack surface, especially for devices on shared or insecure networks. The authentication bypass allows full control over device settings and potentially live video access. The DoS issue means attackers could disrupt monitoring entirely.
Owners must update to firmware version V5_1.4.6 or newer immediately. Additionally, they should limit management interfaces to trusted networks. Businesses should segment IoT devices or place them on separate network zones so that even if one gets compromised, attackers can’t easily pivot to others.
These vulnerabilities underscore a broader pattern: IoT devices continue to suffer from weak input validation, default-overlooked authentication paths, and exposed management interfaces. As homes and small offices increasingly rely on smart cameras, the need for secure development practices and timely patching grows more urgent.
