The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Owners of the Tapo C120 and Tapo C200 should check both the camera model and its hardware revision immediately. Specific revisions can be taken over by an unauthenticated attacker who is already on the same local network, and a separate research disclosure shows how that access could be chained to operating-system command execution in a laboratory demonstration.
Which Tapo cameras are affected?
TP-Link’s August 27, 2026 security advisory identifies two affected hardware revisions:
As an Amazon Associate I earn from qualifying purchases.
| Camera | Hardware revision | Primary vulnerability | Additional issue | Fixed firmware | Network advice |
|---|---|---|---|---|---|
| Tapo C120 | v1 | CVE-2026-15315, authentication bypass (CVSS 8.7, High) | OPSWAT later reported additional CVEs, including a command-injection chain | 1.9.3 Build 260521 or later | Use a segmented IoT network and restrict management access |
| Tapo C200 | v5 | CVE-2026-15315, authentication bypass (CVSS 8.7, High) | CVE-2026-15316, oversized encrypted credentials can crash or restart the camera (CVSS 7.1, High); OPSWAT also reported a command-injection chain | V5_1.4.6 Build 260709 Rel.27675n or later | Use a segmented IoT network and restrict management access |
The hardware revision matters. A model name alone is not enough to determine whether the advisory applies. Check the revision in the Tapo app or on the camera’s label before choosing firmware.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsHow the authentication bypass works
CVE-2026-15315 is an improper-authentication flaw in the login-verification module. TP-Link says weaknesses in validation of challenge parameters allow an attacker on the local network to bypass normal authentication and obtain administrative session tokens.
#1 Best Overall
- ENDLESS POWER FROM SOLAR ENERGY: Just 45 minutes of direct sunlight powers the camera for a full day of use, while the built-in battery lasts up to 180 days on a single charge during cloudy days. Solar charging requires temperatures above 32°F.△
- EASY WIRE-FREE INSTALLATION: Place the Tapo SolarCam C402 KIT where you need it without relying on nearby outlets. Install the camera and solar panel together or separately using the included 13 ft cable for flexible placement.
- PRIORITIZE WHAT MATTERS: Set activity zones to monitor specific areas for motion or people. Free person and motion detection helps reduce unwanted alerts and notifies you when activity is detected.
- VERSATILE VIDEO STORAGE: Store footage locally via a microSD card (up to 512GB)* or via cloud with a Tapo Care cloud subscription. Tailor your security to suit your needs, whether indoor or outdoor, you have the storage option you need.
- FULL-COLOR 1080P, DAY AND NIGHT: See clearly in low light with a large-aperture lens and built-in spotlights. Capture full-color night vision up to 30 ft away to monitor for possible intruders or motion.
The attack does not require a camera password, prior account, or user interaction, but it does require network access to the camera. In practical terms, an attacker would need to be connected to the same reachable home, office or other local network. The disclosures do not establish how many cameras, if any, have been exploited in the wild.
What an attacker could see or change
An administrative session can expose live video, stored recordings and privileged camera controls. That is a confidentiality and control failure even if the camera’s cloud account password has never been disclosed.
Rank #2
- 【2K High Definition】Capture every detail inside your home with crystal-clear 2K high definition video with this indoor security camera. Easily see what your baby is holding or what your pet is playing with.Controller Type:Amazon Alexa;Android;Google Assistant.Connectivity protocol:Wi-Fi.Power source type:Corded Electric, Power Adapter: 100–240 V. Connects via 2.4GHz Wi-Fi Band
- 【Up, Down, All Around】This Pan/Tilt camera see everything across an entire room or walkway with the 360° horizontal and 114° vertical range pan/tilt field of view.
- 【Detection & Instant Notification】Get instant push notifications when motion, person or baby crying is detected, there is no additional fee to use it as a baby camera monitor. Discern from notifications that matter, so you'll know if its your pet playing around or if someone is actually there.
- 【Works w/ Alexa & Google Assistant】Fully compatible with Amazon Alexa and Google Assistant, use your simple voice command to view Tapo indoor security camera live stream on Echo Show or Google Chrome Cast with a screen. Streaming via Google limited to display on Chromecast & Nest devices only.
- 【2-Way Audio w/ Built In Siren】Never truly leave home with the built-in 2-way audio. Use as a pet camera with phone app to comfort your pet from anywhere in the world. Keep your family safe with cameras for home security indoor by warding off intruders.
Why “full control” is a serious warning
OPSWAT’s September 15, 2026 disclosure described the authentication bypass and identified the fixed C200 firmware as V5_1.4.6, released August 18, 2026. Its October 16 follow-up described a further chain involving CVE-2026-102369, a command-injection flaw in the MacTool handler.
According to OPSWAT, an unauthenticated attacker on the same network could combine the bypass with that command-injection weakness to enable diagnostics and execute operating-system commands after a reboot. OPSWAT validated the chain in a controlled laboratory environment and withheld exploit code and reproduction steps. “Complete compromise” therefore describes the demonstrated capability, not confirmed mass exploitation.
Rank #3
- 【Endless Power from Solar Energy】Just 45 minutes of direct sunlight powers the camera for a full day of use, while the built-in battery lasts up to 180 days on a single charge during cloudy days. Solar charging requires temperatures above 32°F.△
- 【Easy Wire-Free Installation - Install Anywhere】Enjoy the flexibility of wire-free installation with the Tapo SolarCam C402 KIT. Free from outlet limitations, you can effortlessly set up the camera and solar panel wherever you need—whether it's the front porch, backyard, garage, or even a remote shed. The innovative design allows for the camera and solar panel to be installed as a unified unit or separately using the included 13-foot cable, providing optimal placement for any scenario.
- 【Prioritize What Matters】Eliminate unnecessary notifications by defining activity zones specifically monitoring for motion or people. Receive real-time alerts for true security concerns with free person/motion detection, eliminating false detection from other objects.
- 【Versatile Video Storage】Store footage locally via a microSD card (up to 512GB)* or via cloud with a Tapo Care cloud subscription. Tailor your security to suit your needs, whether indoor or outdoor, you have the storage option you need.
- 【Full-Color 1080P, Day and Night】Achieve crystal-clear visibility even in complete darkness, thanks to the large aperture lens and built-in spotlights. Capture vibrant color night vision up to 30ft away for enhanced security to monitor for possible intruders or motion.
Operating-system access could allow malware installation, persistence and attacks against other reachable internal services. The follow-up also listed CVE-2026-9032 (CVSS 7.1, High), CVE-2026-78578 (CVSS 7.1, High) and CVE-2026-78577 (CVSS 5.3, Medium), in addition to CVE-2026-102369 (CVSS 8.7, High). The disclosures do not provide enough detail to assign a separate impact description to each of those three CVEs.
Another C200 problem can disrupt monitoring
CVE-2026-15316 affects C200 hardware v5. TP-Link says oversized encrypted credential values can trigger exception-handling failures, causing the camera to crash or restart. During the failure, HTTPS management and monitoring can be temporarily disrupted. This is a denial-of-service condition rather than the authentication bypass, but it affects the same C200 v5 hardware and is fixed by the firmware listed above.
Rank #4
- 2024 PCMag Editor's Choice - Praised for its outstanding value, delivering sharp 2K resolution and a comprehensive feature set.
- Compact, Versatile, Weatherproof - The Tapo C120 is a compact camera suitable for indoor and outdoor use, featuring an IP66 rating for withstanding rain, dust, and rugged conditions.
- Magnetic Base for Flexible Mounting - Easily attach the C120 camera to any metal surface with its magnetic base. Versatile mounting on railings, frames, or even the refrigerator.
- 2K QHD 4MP Resolution - Crystal-clear detail in every shot. Capture every moment with stunning 2K quality that ensures even the finest details are never missed.
- Starlight Color Night Vision - The built-in Starlight sensor delivers bright, colorful video at night, with two spotlights for extra illumination in darker conditions.
Firmware versions that fix the issue
- Tapo C120 hardware v1: install firmware 1.9.3 Build 260521 or a later release.
- Tapo C200 hardware v5: install firmware V5_1.4.6 Build 260709 Rel.27675n or a later release.
Use the release for the exact hardware revision. Do not substitute firmware intended for another revision or another Tapo model.
How to update safely
- Open the Tapo app and locate the camera’s device information, or read the model and hardware revision from the device label.
- Go to TP-Link’s official download page for that exact model and revision. Compare the posted build with the fixed version above.
- Install the update and leave the camera powered and connected until the process completes. A restart during installation is expected; interrupting power can create a separate recovery problem.
- After the camera returns online, confirm the installed firmware build in the app’s device information.
- If compromise is possible, change the camera and associated account credentials, review settings, and remove unknown users, devices or integrations.
Containment steps while you patch
- Move cameras to a separate IoT VLAN or other segmented network.
- Use firewall rules or access-control lists to limit which devices can reach camera-management interfaces.
- Keep management access off untrusted networks and avoid exposing the camera’s administration interface directly to the internet.
- Review router and camera logs for unfamiliar connections, unexpected reboots or configuration changes.
Segmentation limits what a compromised camera can reach, but it does not replace the firmware update. The disclosed attack begins with local-network access, so reducing that reach lowers the opportunity for exploitation.
Best Value
- 2K HIGH DEFINITION: Capture every detail inside your home with crystal-clear 2K high definition video with this indoor security camera. Easily see what your baby is holding or what your pet is playing with. 2.4 GHz Wi-Fi required.
- SEE MORE WITH PAN/TILT: This Pan/Tilt IP camera see everything across an entire room or walkway with the 360° horizontal and 114° vertical range pan/tilt field of view.
- NO SUBSCRIPTION STORAGE OPTION - Store recordings on a microSD card at no cost◇ (up to 512GB) or subscribe to Tapo Care's cloud storage.
- DETECTION & INSTANT NOTIFICATIONS: Get instant push notifications when motion, a person, or a baby crying is detected. No additional fee is required for baby monitoring. Smart detection helps distinguish pets from people.
- WORKS W/ ALEXA & GOOGLE ASSISTANT: Use voice commands to view your Tapo camera’s live stream on Echo Show, Chromecast, or Nest displays. Google streaming is limited to Chromecast and Nest devices.
Do these advisories apply to every Tapo camera?
No. TP-Link published separate 2026 denial-of-service advisories for the C100 v5, C210 v3, C220 v1 and C520WS v2. Those notices are distinct from the C120/C200 authentication-bypass story. Identify the model and hardware revision first, then follow the advisory and firmware listing for that device.
What owners should do now
If you own a C120 v1 or C200 v5, treat the update as urgent: install the fixed build, rotate credentials if compromise is suspected, inspect the configuration and isolate the camera on a restricted IoT network. The evidence describes a high-severity local-network path to administrative access and a laboratory-demonstrated route to operating-system command execution; it does not, by itself, prove active exploitation at scale.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
