TP-Link has addressed two serious vulnerabilities in its Tapo C200 and C120 models, which could have enabled local attackers to gain complete control over devices, raising concerns for households and small offices utilizing these connected security cameras.
TP-Link has fixed a security weakness in its Tapo home cameras that could let a person already on the same network gain administrator access without a password. The issue affects the Tapo C200 and, in one hardware revision, the Tapo C120, according to the company’s own security notice and reporting by The Ambient.
Security researchers at OPSWAT found that the flaw sat in the cameras’ HTTPS management interface. In practice, the weakness allowed an attacker to follow an alternative verification route and obtain an admin session after a small number of requests. That would open access to live video, recordings and settings changes, with particular concern for devices used as baby monitors.
OPSWAT identified a second flaw as well, which TP-Link has also patched. That issue could be triggered by an oversized encrypted Wi-Fi credential input and might crash the HTTPS service or force the camera to restart. TP-Link says the two vulnerabilities are tracked as CVE-2026-15315 and CVE-2026-15316, with the first carrying the higher severity rating.
The company’s advisory says the problems affect the Tapo C120 v1 and the Tapo C200 v5, and that firmware updates are available. Although both flaws require an attacker to already be on the same local network or inside a trusted environment, the access they could provide makes them significant for households and small offices alike. TP-Link has also published separate advisories for other Tapo camera vulnerabilities, underlining the broader security pressure on connected home devices.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
