TP-Link Tapo C120 V1 and C200 V5 Share One Broken Login (CVE-2026-15315)
The research came from OPSWAT. OPSWAT researchers Khoi Tran and Thai Do discovered the flaws, tracked as CVE-2026-15315 and CVE-2026-15316, during the company's Critical Infrastructure Cybersecurity Graduate Fellowship Program. OPSWAT's write-up covers only the Tapo C200. TP-Link's own security advisory, last updated August 27, 2026, gives a wider scope: the authentication bypass affects both the Tapo C120 V1 and the Tapo C200 V5, while the denial-of-service bug affects only the C200 V5.
Early coverage often skipped that detail. TechRadar's report, for example, led with the C200 and mentioned the C120 later. Anyone with a C120 should treat the authentication bypass as their problem too.
TP-Link lists these fixed builds in its advisory:
| Camera and hardware version | Vulnerabilities | Fixed firmware |
|---|---|---|
| Tapo C120 V1 | CVE-2026-15315 | 1.9.3 Build 260521 |
| Tapo C200 V5 | CVE-2026-15315 and CVE-2026-15316 | V5_1.4.6 Build 260709 Rel.27675n |
TP-Link scores CVE-2026-15315 at 8.7 (High) under CVSS v4.0. The vector string says the attack needs adjacent-network access, with low complexity, no privileges and no user interaction. CVE-2026-15316 scores 7.1 (High) and affects availability only. Several independent outlets confirm the scores, including Android Headlines, which reported a severity score of 8.7/10 for the bypass and a severity score of 7.1/10 for the second flaw.
How a Replayed Value Defeats the Tapo Challenge-Response Login
The bypass is a logic error in how the camera checks who is logging in. CVE-2026-15315 is an authentication-bypass vulnerability affecting the camera's local HTTPS management interface, which listens on port 443. That interface uses challenge-response authentication: the camera sends a challenge, and the client has to answer with a value that can only be calculated if it knows the owner's password. The password never crosses the network, and a stranger can't produce the right answer.
OPSWAT found a second way through. The Tapo C200 uses a challenge-response authentication process intended to verify that a client knows the administrator's password before creating an authenticated session. OPSWAT found that an alternative verification path failed to enforce the same credential-validation requirements. In OPSWAT's description, a value the camera itself hands out during login can, under certain conditions, be sent back in a later request and accepted as a valid answer. The camera ends up checking its own output instead of proof that the client knows the password. TP-Link's advisory names the bug "Unauthenticated Administrative Authentication Bypass via device_confirm Replay" and describes it as weak validation of challenge parameters.
It doesn't take much effort. According to OPSWAT, as quoted by one analysis, it takes "only a handful of malicious requests." OPSWAT says the attacker needs no password, no existing session and no action from the owner, and ends up with an administrator session.
An administrator session is full control of the device. OPSWAT says it includes live video, stored footage and privileged configuration changes. For a C200 used as a baby monitor, the researchers list the exposure as live video, night vision, crying detection and two-way audio. TP-Link's advisory adds that exploitation can also cause temporary disruption of device services. OPSWAT held back the implementation details needed to reproduce the attack, and nothing published so far reports the bypass being used against real users.
CVE-2026-15316 Can Knock the Tapo C200 Offline
The second bug affects only the C200 V5 and does less damage. The second issue, CVE-2026-15316, is a denial-of-service vulnerability in the Tapo C200 Wi-Fi onboarding process. The vulnerable code processes encrypted Wi-Fi credential data without adequately validating its size before passing it to cryptographic and configuration-related routines. If an attacker sends an oversized encrypted credential value, the camera's HTTPS service can crash. TP-Link says the whole device may crash or restart.
This bug does not give anyone access to the camera. While the flaw does not provide administrative access, it can disrupt legitimate camera management until the affected service recovers. In practice, the owner can lose monitoring and management for a while. That is a problem for a camera meant to watch a room, but it doesn't expose anyone's privacy.
Reports disagree on one point. Cybernews called CVE-2026-15316 an "authenticated" vulnerability. TP-Link's published CVSS vector lists no privileges required (PR:N), and OPSWAT describes both flaws as exploitable by an unauthenticated attacker with network access. Go with the vendor and the researchers: no login is needed.
"Same Network" Is the Real Limit on the Tapo Attacks
Headlines about hackers watching you sleep make these flaws sound more reachable than they are. Both CVSS vectors use AV:A, meaning adjacent network: the attacker has to be able to reach the camera's local interface, which usually means being on the same LAN or Wi-Fi. TP-Link's advisory describes the bypass attacker as being "on the local network." Nothing published says a Tapo camera can be taken over directly from the internet through these bugs.
That limit is a real reduction in risk, but it doesn't make the flaws harmless. The attacker doesn't have to sit in your house. One consumer-security guide points out that an older router, a cheap smart plug with weak security, or a malware-infected laptop can give an attacker a foothold inside your network. Once they are "inside," these Tapo flaws would let them move from simply being on your Wi-Fi to taking control of the C120 V1 or C200 V5, unless you have installed the fixed firmware. Shared flats, small offices that use consumer cameras, and networks with guests who have the Wi-Fi password face the most direct risk.
OPSWAT puts the risk in network terms too. A vulnerability that allows an attacker to bypass authentication or access privileged functionality could compromise the camera and potentially provide a foothold within the network where the device is deployed. Its remediation advice beyond patching is to keep camera management interfaces off untrusted networks, limit access to authorized devices and users, and put IoT and surveillance devices on segmented networks in business settings. OPSWAT sells network access control products, so that advice is also a sales pitch. Separating IoT devices from the rest of the network is still ordinary, vendor-neutral practice.
A Third, Critical Tapo Flaw Is Still Undisclosed
The two published CVEs are only part of what OPSWAT found. OPSWAT reported that another flaw found during investigation could let an attacker take full control of the camera and use it to attack other devices on the same network. However, details of this vulnerability have not been publicly released while the security firm works with TP-Link to confirm and fix it. OPSWAT rates it critical and says it will publish details once fixes are available and coordinated disclosure is complete.
Readers need two things from this. First, the firmware builds in the table above fix CVE-2026-15315 and CVE-2026-15316, and nothing published says they also fix the third flaw. Second, neither OPSWAT nor TP-Link has given a release date for that fix. Some sites have guessed at what kind of bug it is. Those guesses have no support in OPSWAT's disclosure, so don't read anything into them.
The disclosure process for the first two flaws went smoothly, which bodes well for the third:
- OPSWAT reported the vulnerabilities to TP-Link on April 16, 2026.
- TP-Link confirmed the findings and started work on fixes on July 10, 2026.
- The CVE identifiers were assigned on August 13, 2026.
- TP-Link released firmware version V5_1.4.6 addressing the vulnerabilities and published the corresponding security advisory on August 18, 2026.
- OPSWAT published its technical account on September 15, 2026, and TP-Link's advisory was last revised on August 27.
The C120 fix may have been out earlier. TP-Link's US download page lists build 1.9.3 Build 260521, the same build number the advisory gives as the C120 fix, as published on June 18, 2026, for the C120 V1.6. Its only change note is "Enhanced device stability and security." That page also says hardware version V1.0 is equivalent to V1.6/V1.8. Our reading is that US C120 owners who accepted updates over the summer may already have been protected before the flaw was made public. TP-Link hasn't said so directly, so check the build number on your own camera.
Matching Firmware to Hardware Revision Is the Hard Part of the Tapo Fix
The patch exists, and the only tricky part is making sure you have the right one. TP-Link's advisory is specific to hardware revisions: C120 V1 and C200 V5. The company warns that model and hardware-version availability varies by region. Its US C120 download page offers V1.60, V1.26 and V1 firmware separately. "Tapo C120" or "Tapo C200" alone isn't enough to pick a firmware file.
TP-Link offers two official update routes: the Tapo app, which has a documented firmware-update procedure for Tapo and Kasa devices, and the regional download page for each model and hardware version. Its support site also has a guide to finding the hardware and firmware version of a TP-Link device. The hardware revision is usually on the device label and shows in the app's device information.
Checking and updating a Tapo C120 or C200
- Find the camera's exact model and hardware version, and confirm whether it is a C120 V1 (including its V1.6/V1.8 equivalents) or a C200 V5.
- Open the camera in the Tapo app and note the current firmware version.
- Compare it with the fixed build for your hardware: 1.9.3 Build 260521 or later for the C120 V1, and V5_1.4.6 Build 260709 Rel.27675n or later for the C200 V5.
- If the camera is older than the fixed build, install the update through the Tapo app or from TP-Link's regional download page for your exact hardware version.
- After the update, check that the camera reports at least the fixed build.
Never flash a file meant for a different hardware revision or region. If an update fails, TP-Link has a separate support article for failed Tapo and Kasa firmware updates. Changing the camera account password is sensible hygiene, but TP-Link's advisory doesn't list it as a fix, and it shouldn't be. The bug works without the password.
Owners of other Tapo C200 revisions, or other Tapo models, aren't listed as affected by these two CVEs. That doesn't mean their firmware is safe. Keep automatic updates on regardless.
What this means for you
If you own a Tapo C120 V1 or C200 V5, check its firmware version today. Anyone whose camera already reports the fixed build is done for now and should watch for the next update.
- The authentication bypass CVE-2026-15315 (CVSS 8.7) affects both the Tapo C120 V1 and the Tapo C200 V5, and it lets someone on your local network get administrator access, live video and recordings without your password.
- The denial-of-service flaw CVE-2026-15316 (CVSS 7.1) affects only the Tapo C200 V5 and can crash the camera's HTTPS service or restart the device, but it doesn't give access to video.
- The fixed builds are 1.9.3 Build 260521 for the C120 V1 and V5_1.4.6 Build 260709 Rel.27675n for the C200 V5, and you should confirm your hardware revision and region before installing anything.
- Both attacks need access to the camera's local network, so an up-to-date router, restricted guest access and a separate network segment for IoT devices reduce exposure, but they don't replace the firmware update.
- OPSWAT has an undisclosed critical flaw in the same camera line still in coordinated disclosure, and there is no public patch date, so keep automatic updates enabled and check again when TP-Link revises its advisory.
The Tapo bypass is a textbook challenge-response mistake that turned a $30-class camera into an open door for anyone already on the network. TP-Link and OPSWAT handled disclosure responsibly, and the fix is in the Tapo app for owners who use the correct hardware revision. The next milestone is OPSWAT's disclosure of the critical third flaw, which should come with its own firmware build and a new round of checks for anyone who has one of these cameras in a nursery or a small office.