On 16 October 2026 OPSWAT published the last part of its research into TP-Link's Tapo C200 and C120 cameras. The main flaw, CVE-2026-102369, is a command injection in a factory diagnostic service. On its own it needs administrator access, but an authentication bypass disclosed in August provides exactly that. Chained together, the two let an attacker on the same local network go from no password to running operating system commands on the camera.

TP-Link has already fixed it. Its advisory, last updated on 1 October, lists the fixed firmware:

  • Tapo C200 V5: V5_1.4.6 Build 260709 Rel.27675n
  • Tapo C120 V1: V1_1.9.4 Build 260813 Rel.79754n

How the chain works

The first link is CVE-2026-15315, which TP-Link disclosed in August. The camera's local HTTPS management interface uses challenge-response login, but one code path accepts a value that the camera itself sent during the exchange. Replaying that value gives an administrator session without the owner's password.

With that session, an attacker can switch on TMPD, a diagnostic service meant for manufacturing and maintenance, and reboot the camera. TMPD's MacTool handler builds shell commands for TFTP file transfers from the parameters it receives, without proper validation, so a crafted parameter runs as a command. TP-Link rates the flaw 8.7 on CVSS v4.0. OPSWAT validated the full chain in its lab and left out exploit code and detailed steps.

OPSWAT stresses that the damage goes beyond a leaked video feed. With access to the camera's operating system, an attacker could install malware, stay on the device and use it to scan or attack anything else it can reach on the network.

Three more fixes

The same advisory covers three flaws in the Wi-Fi onboarding interface. All of them can be reached without logging in, even after initial setup:

  • CVE-2026-78578 (7.1): an attacker can push new Wi-Fi settings, so the camera tries to join another network and drops off its own.
  • CVE-2026-9032 (7.1): a malformed onboarding request crashes the HTTPS service. Repeated requests can keep it down, and recovery may need a reboot.
  • CVE-2026-78577 (5.3): the camera hands out a scan of nearby access points, with SSIDs, BSSIDs, encryption modes and signal strength.

The advisory's headline lists CVE-2026-78579, while its text and OPSWAT's write-up use CVE-2026-78577 for the scan flaw. Counting the two CVEs from August, the research produced six in total.

What to do

Every one of these flaws needs access to the same local network as the camera, and Cybernews notes there is no evidence yet of attacks on real owners. In a home, though, that is a low bar: guests, a smart TV and every other device share the same Wi-Fi, and any of them could be compromised. Check the firmware of each C200 V5 and C120 V1 and update it if it is older than the builds listed above. OPSWAT also recommends keeping cameras on a separate network segment, so one compromised device cannot reach the rest of the home.