TP‑Link releases firmware fixing six flaws in Tapo C200 V5 and C120 V1

TP‑Link released firmware version V5_1.4.6 on August 18, 2026, patching CVE‑2026‑15315 and CVE‑2026‑15316.

OPSWAT researchers Khoi Tran and Thai Do disclosed a command‑injection flaw (CVE‑2026‑102369) in TP‑Link Tapo cameras that attackers can chain with an authentication bypass to gain full control. Combining the authentication bypass (CVE‑2026‑15315) with the command‑injection flaw lets attackers on the same network gain admin access, enable a diagnostic tool, and run commands.

The authentication bypass alone allows an attacker with network access to get a valid administrator session without knowing the user’s password, enabling invocation of privileged management functions, modification of device configuration, and access to live video streams and stored recordings.

Researchers identified three flaws: a Wi‑Fi configuration change flaw (CVE‑2026‑78578), an information‑disclosure flaw (CVE‑2026‑78577), and an HTTPS service crash flaw (CVE‑2026‑9032). These flaws let attackers change Wi‑Fi settings without login, view nearby network details, or lead to the crash of the camera’s HTTPS service.

A separate denial‑of‑service flaw (CVE‑2026‑15316) can be triggered by submitting an oversized encrypted credential value, leading to the crash of the camera’s HTTPS service.

A compromised camera can be used to install malware, establish persistent access, and launch attacks against other devices on the same network. The vulnerabilities can only be exploited by an attacker who is already on the same local network as the TP‑Link Tapo camera. There is no public evidence that any of the six flaws have been exploited against real TP‑Link camera owners.

Earlier research in September 2026 revealed a Tapo camera flaw that allowed attackers to spy on owners via live video streams. OPSWAT researchers Khoi Tran and Thai Do noted that the diagnostic service improperly handles external input, creating a significant security risk.

OPSWAT is working with TP‑Link on a third, currently unpatched zero‑day. It rates the flaw as critical and says it could allow full camera compromise and network foothold.

Dahvid Schloss said the authentication bypass requires local network access. He said it is less useful unless the camera is port‑forwarded to the internet. TP‑Link is a Chinese manufacturer. It produces smart home devices, including the Tapo camera line.

TP‑Link released firmware updates fixing six vulnerabilities in Tapo C200 V5 and C120 V1 cameras, including the command‑injection and authentication‑bypass flaws. Firmware version V5_1.4.6, released on August 18, 2026, patches CVE‑2026‑15315 and CVE‑2026‑15316.