TP-Link published two security advisories for Tapo cameras on 19 October 2026, and the three flaws they describe reached the National Vulnerability Database the same day. Two affect the Tapo C210 with hardware version 3.6, one affects the Tapo C320WS with hardware version 2. Each of them needs an attacker on the same local network as the camera, and fixed firmware is already out for both models.

These are separate from the Tapo C200 and C120 flaws that OPSWAT described on 16 October.

Tapo C210: two flaws, no login needed

Both C210 bugs are in the camera's DS JSON API and can be reached without signing in.

CVE-2026-105814 (CVSS v4.0: 5.3, medium) is an authentication bypass. When a JSON request combines a protected operation with public fields used during onboarding, the camera applies its authorization checks inconsistently and runs the protected operation without a valid session. TP-Link gives pan-tilt-zoom control as the example, so someone on the network could turn the camera to face elsewhere.

CVE-2026-105815 (7.1, high) matters more for privacy. Unauthenticated API requests can expose shared credential material and cryptographic metadata. The camera's Streamd service accepts that shared credential as an administrator password in Digest authentication, so an attacker can open encrypted media sessions without knowing the account password.

The fix is firmware V3.6_1.2.7 Build 260818.

Tapo C320WS: root, but only after login

CVE-2026-105810 (8.5, high) is a stack-based buffer overflow in the local Wi-Fi configuration path used during onboarding. A request with an oversized encrypted password field overwrites the stack and runs commands with root privileges. The attacker must already be authenticated, and the CVSS vector rates the required privileges as high. Whoever gets that far can take over the camera, change how it behaves, read sensitive local configuration and knock it offline.

The fix is firmware 1.6.6 Build 260917 Rel.81089n.

The C320WS advisory has a small mix-up: its title says CVE-2026-105810, while the heading in the body uses CVE-2026-105814, the number of the C210 bypass. NVD lists the overflow as CVE-2026-105810.

What to do

Check the firmware version of every C210 V3.6 and C320WS V2 you own and update any camera running an older build than the ones above. TP-Link links the firmware from each advisory.

None of the three flaws can be used from the internet, but a home network is a low bar: guests' phones, a TV and every other device on the same Wi-Fi count as "adjacent". If your router supports it, a separate network for cameras keeps a compromised device elsewhere in the house away from them.