What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Owners of Tapo C120 hardware v1 and Tapo C200 hardware v5 should update immediately. A local-network attacker can bypass camera authentication and obtain an administrator session. Security researchers later demonstrated that the access can be chained with another flaw to run operating-system commands in a controlled laboratory test. The fixed firmware is 1.9.3 Build 260521 or later for C120 v1, and V5_1.4.6 Build 260709 Rel.27675n or later for C200 v5.
Which Tapo cameras are affected?
TP-Link’s August 27, 2026 security advisory identifies two hardware revisions:
| Camera and hardware revision | Relevant vulnerability | What an attacker needs | Potential impact | Fixed firmware |
|---|---|---|---|---|
| Tapo C120 v1 | CVE-2026-15315 authentication bypass; OPSWAT also reports additional 2026 CVEs affecting this revision | Unauthenticated access to the same local network; no user interaction | Administrator session access; live video, recordings and privileged controls may be exposed. OPSWAT demonstrated an operating-system command chain in a controlled laboratory environment. | 1.9.3 Build 260521 or later |
| Tapo C200 v5 | CVE-2026-15315 authentication bypass and CVE-2026-15316 encrypted-credential handling flaw; OPSWAT also reports additional 2026 CVEs | Unauthenticated access to the same local network; no user interaction | Administrator session access, possible video and settings exposure, and temporary crashes or restarts. The OPSWAT chain can reach operating-system command execution in laboratory testing. | V5_1.4.6 Build 260709 Rel.27675n or later |
The hardware revision matters. A model name alone is not enough to determine whether a camera is covered by these advisories.
How the attack works
Authentication bypass (CVE-2026-15315)
TP-Link describes an improper-authentication flaw in the login-verification module. Weaknesses in challenge-parameter validation let an attacker on the local network bypass normal login checks and obtain administrative session tokens. TP-Link rates this vulnerability CVSS 8.7 (High).
#1 Best Overall
- 2024 PCMag Editor's Choice - Praised for its outstanding value, delivering sharp 2K resolution and a comprehensive feature set.
- Compact, Versatile, Weatherproof - The Tapo C120 is a compact camera suitable for indoor and outdoor use, featuring an IP66 rating for withstanding rain, dust, and rugged conditions.
- Magnetic Base for Flexible Mounting - Easily attach the C120 camera to any metal surface with its magnetic base. Versatile mounting on railings, frames, or even the refrigerator.
- 2K QHD 4MP Resolution - Crystal-clear detail in every shot. Capture every moment with stunning 2K quality that ensures even the finest details are never missed.
- Starlight Color Night Vision - The built-in Starlight sensor delivers bright, colorful video at night, with two spotlights for extra illumination in darker conditions.
The attacker does not need a camera password, an existing account or interaction from the owner. However, the disclosed condition requires local-network access, such as being connected to the same home, office or other network. The disclosures do not establish that an attacker can reach the camera directly from the public internet.
What administrative access exposes
An administrator session can expose the live camera feed, stored recordings and privileged configuration controls. That means a successful attacker could view or manipulate more than an ordinary viewer account, depending on which functions the device exposes through that session.
Rank #2
- The information below is per-pack only
- 2024 PCMag Editor's Choice - Praised for its outstanding value, delivering sharp 2K resolution and a comprehensive feature set.
- Compact, Versatile, Weatherproof - The Tapo C120 is a compact camera suitable for indoor and outdoor use, featuring an IP66 rating for withstanding rain, dust, and rugged conditions.
- Magnetic Base for Flexible Mounting - Easily attach the C120 camera to any metal surface with its magnetic base. Versatile mounting on railings, frames, or even the refrigerator.
- 2K QHD 4MP Resolution - Crystal-clear detail in every shot. Capture every moment with stunning 2K quality that ensures even the finest details are never missed.
Crash and restart flaw (CVE-2026-15316)
This issue affects C200 v5. Oversized encrypted credential values can trigger exception-handling failures, causing the camera to crash or restart. During the disruption, HTTPS management and monitoring can be temporarily unavailable. TP-Link rates CVE-2026-15316 CVSS 7.1 (High). It is distinct from the authentication bypass, but it is covered by the same C200 v5 firmware update.
From camera access to operating-system commands
In an October 16, 2026 follow-up, OPSWAT reported four additional CVEs affecting C200 v5 and C120 v1. The most consequential is CVE-2026-102369, a command-injection flaw in the MacTool handler. Chained with CVE-2026-15315, it can allow an unauthenticated same-network attacker to enable diagnostics and execute operating-system commands after a reboot.
Rank #3
- 【2K High Definition】Capture every detail inside your home with crystal-clear 2K high definition video with this indoor security camera. Easily see what your baby is holding or what your pet is playing with.Controller Type:Amazon Alexa;Android;Google Assistant.Connectivity protocol:Wi-Fi.Power source type:Corded Electric, Power Adapter: 100–240 V. Connects via 2.4GHz Wi-Fi Band
- 【Up, Down, All Around】This Pan/Tilt camera see everything across an entire room or walkway with the 360° horizontal and 114° vertical range pan/tilt field of view.
- 【Detection & Instant Notification】Get instant push notifications when motion, person or baby crying is detected, there is no additional fee to use it as a baby camera monitor. Discern from notifications that matter, so you'll know if its your pet playing around or if someone is actually there.
- 【Works w/ Alexa & Google Assistant】Fully compatible with Amazon Alexa and Google Assistant, use your simple voice command to view Tapo indoor security camera live stream on Echo Show or Google Chrome Cast with a screen. Streaming via Google limited to display on Chromecast & Nest devices only.
- 【2-Way Audio w/ Built In Siren】Never truly leave home with the built-in 2-way audio. Use as a pet camera with phone app to comfort your pet from anywhere in the world. Keep your family safe with cameras for home security indoor by warding off intruders.
OPSWAT says the chain was validated in a controlled laboratory environment and that it withheld exploit code and reproduction steps. The demonstrated outcome could enable malware, persistence or attacks against other reachable internal services, but the disclosures do not provide a verified count of real-world exploitation.
OPSWAT lists these severities for the additional issues:
Rank #4
- ENDLESS POWER FROM SOLAR ENERGY: Just 45 minutes of direct sunlight powers the camera for a full day of use, while the built-in battery lasts up to 180 days on a single charge during cloudy days. Solar charging requires temperatures above 32°F.△
- EASY WIRE-FREE INSTALLATION: Place the Tapo SolarCam C402 KIT where you need it without relying on nearby outlets. Install the camera and solar panel together or separately using the included 13 ft cable for flexible placement.
- PRIORITIZE WHAT MATTERS: Set activity zones to monitor specific areas for motion or people. Free person and motion detection helps reduce unwanted alerts and notifies you when activity is detected.
- VERSATILE VIDEO STORAGE: Store footage locally via a microSD card (up to 512GB)* or via cloud with a Tapo Care cloud subscription. Tailor your security to suit your needs, whether indoor or outdoor, you have the storage option you need.
- FULL-COLOR 1080P, DAY AND NIGHT: See clearly in low light with a large-aperture lens and built-in spotlights. Capture full-color night vision up to 30 ft away to monitor for possible intruders or motion.
- CVE-2026-102369: CVSS 8.7 (High)
- CVE-2026-9032: CVSS 7.1 (High)
- CVE-2026-78578: CVSS 7.1 (High)
- CVE-2026-78577: CVSS 5.3 (Medium)
Firmware versions that fix the problem
Install the update for the exact hardware revision, not merely the same product family. TP-Link lists these fixed builds:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- Tapo C120 v1: firmware 1.9.3 Build 260521 or newer.
- Tapo C200 v5: firmware V5_1.4.6 Build 260709 Rel.27675n or newer.
OPSWAT identifies C200 firmware V5_1.4.6 as released on August 18, 2026; TP-Link’s advisory specifies the complete fixed build as V5_1.4.6 Build 260709 Rel.27675n. Use the complete build shown for your device when checking the download or update screen.
Best Value
- 【2K High Definition】Capture every detail inside your home with crystal-clear 2K high definition video with this indoor security camera. Easily see what your baby is holding or what your pet is playing with. Connects via 2.4GHz Wi-Fi Band
- 【Up, Down, All Around】This Pan/Tilt IP camera see everything across an entire room or walkway with the 360° horizontal and 114° vertical range pan/tilt field of view.
- 【Secure Local or Cloud Storage】Save footage continuously on up to a 512 GB microSD card (not included) or subscribe to Tapo Care for cloud storage which saves 30-day video history and provides additional benefits such as motion tracking, baby crying detection, and more. [Before purchasing a microSD card, please check the TP-Link website FAQ to ensure compatibility with your device.]
- 【Detection & Instant Notification】Get instant push notifications when motion, person or baby crying is detected, there is no additional fee to use it as a baby camera monitor. Discern from notifications that matter, so you'll know if its your pet playing around or if someone is actually there.
- 【Works w/ Alexa & Google Assistant】Fully compatible with Amazon Alexa and Google Assistant, use your simple voice command to view Tapo indoor security camera live stream on Echo Show or Google Chrome Cast with a screen. Easily get your home security footage up on a larger TV display.
How to update and contain a vulnerable camera
- Identify the model and hardware revision in the Tapo app’s device information or on the camera’s label. Confirm that it is C120 v1 or C200 v5.
- Use TP-Link’s official download or firmware-update page for that exact model and revision.
- Install the C120 or C200 fixed build listed above, or any later build offered for the same hardware revision. Keep the camera powered until the update completes and it reboots.
- If compromise is possible, change the camera and associated account credentials after updating. Review camera settings and remove unknown users, devices or integrations.
- Move the camera to a separate IoT network or VLAN. Use router access-control lists or equivalent rules to limit which systems can reach camera-management interfaces.
- Restrict management access to trusted administration devices and avoid exposing camera-management ports to the internet.
Segmentation limits what a compromised camera can reach, while restricting management access reduces the number of devices from which an attacker could attempt the local-network exploit.
Do other Tapo models have the same issue?
Not according to the advisories summarized here. TP-Link published separate 2026 denial-of-service advisories for C100 v5, C210 v3, C220 v1 and C520WS v2. Those notices concern a different issue from the C120/C200 authentication-bypass story. Check the precise model and hardware revision before applying either the firmware or the mitigation guidance.
What owners should conclude
The practical risk is highest when an affected camera shares a broadly accessible network with guests, untrusted devices or systems containing sensitive data. Update first, then rotate credentials if compromise is suspected and isolate the camera on an IoT or VLAN segment. The authentication bypass is rated High severity, and the later command-execution demonstration shows why treating the firmware update as urgent is warranted even though public exploitation has not been quantified.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
