OPSWAT recently published threat research on two newly discovered vulnerabilities in TP-Link Tapo cameras. The Tapo brand serves more than 50 million global users in 170 countries and regions, with the Tapo C200 serving as an affordable, popular home camera that is often repurposed as a baby or pet monitor. As such, users place implicit trust in the reliability and security of the device, leaving them unprepared for these cameras to be vulnerable to attacks.
Bypassing Password Protection
The first vulnerability found by OPSWAT is tracked as CVE-2026-15315 with a high-severity CVSS score of 8.7, and it affects Tapo C120 v1 and C200 v5. It is an authentication bypass that enables an attacker to use an alternative authentication path that does not require credential verification in the same way that the expected authentication flow is designed to. The alternative path exploits challenge parameter validation weaknesses to access administrative session tokens without proper authentication.
With only a few requests, this flaw can allow threat actors full administrator access without the need for any owner credentials. They can potentially execute privileged actions, enable administrative access without authorization, and even disrupt the service of the compromised device.
What Gets Exposed
Through exploitation of CVE-2026-15315, the camera’s live feeds and stored recordings alike can be exposed. The night vision and crying detection features are also within the attacker’s reach and potentially compromised. Two-way audio provides a direct line into the nursery that a bad actor can exploit for malicious ends.
This level of exposure is quite alarming for users of the affected Tapo cameras. For those who use these devices to keep an eye on their children or pets, an attacker having potential access to those feeds and the ability to communicate through the device is a significant risk. Disruption of service is also a major concern for these customers.
Cutting Off Legitimate Access
The second disclosed vulnerability, CVE-2026-15316, has a high-severity CVSS score of 7.1. This flaw is an improper input validation vulnerability that can enable an attacker to crash the device’s management service. They can trigger exception handling failures during Wi-Fi onboarding by sending oversized encrypted ciphertext values that cause insufficient validation.
The compromised device then shuts down or restarts, silently dropping offline without alerting the user. Parents relying on the camera assume that it is continuously monitoring their child, when in actuality service has been interrupted.
More Unknown Flaws
The two vulnerabilities explored in the published threat research have been patched in TP-Link’s firmware version V5_1.4.6 since OPSWAT’s responsible disclosure. Other security flaws were also uncovered during the research, including one vulnerability that is being withheld pending a fix being developed.
This third vulnerability has the potential to enable an attacker to achieve complete device compromise and maintain the compromised device as a foothold inside the network to allow attacks on other home devices.
The Same Network Doesn’t Guarantee Security
Many users assume that devices connected via Wi-Fi on the same network are inherently secure against attacks from outside the home. Shared Wi-Fi networks, visiting guests, and neighbors within the reach of the network can all obtain access without much difficulty or technical hurdles. Compromised laptops or IoT devices can act as entry points and allow attackers to infiltrate the network.
Many home Wi-Fi networks are flat networks with no segmentation, meaning all devices connected to the same network are easy to connect to each other through an attack chain. Once an attacker is within the network, they can often easily gain access to more critical devices on the network, opening the door for further malicious activity that affects more than just home cameras. “These cameras sit on the same network as every other device in the home, so once an attacker has administrator access, the camera stops being just a privacy problem,” says Seemant Sehgal, Founder & CEO, BreachLock. “It becomes a foothold for reaching everything else on that network.”
Patching Is Only Half the Fix
The TP-Link firmware updates that addressed the two published vulnerabilities were released on August 18th, four months after the disclosure by OPSWAT’s researchers. While the patch released by the company is a crucial part of the equation of remediating these flaws, it does not guarantee security. Fully securing these devices requires action by multiple parties. The ongoing coordination between OPSWAT and TP-Link regarding the remaining vulnerability also leaves unanswered questions regarding securing these devices.
Consumer devices are rarely updated by owners, who must take steps to patch vulnerabilities that they may never even pay attention to. Users often assume security by default in devices like this and fail to take necessary security actions. “While firmware patches are available now, the burden falls on device owners to install the update, and most are likely not paying close enough attention to know one exists,” according to Sehgal. “This is the part of the disclosure process that consumer devices consistently fail.”
Rethinking Trust Inside the Home
In order to address severe vulnerabilities, it is crucial for owners of these cameras and similar devices to treat the local network as untrusted territory, not secure by default. They are also encouraged to enable auto-updates and network isolation for cameras to avoid going unpatched and prevent lateral movement within the network using the camera as an entry point. The disclosure of these vulnerabilities and unpublished further flaws places pressure on vendors to design these devices for hostile networks and protect them against attacks.
