# TP-Link Tapo Camera Flaws Let Local Attackers Take Full Control

- URL: https://usa-24.com/tp-link-tapo-camera-vulnerability/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-17T08:49:44.646Z
- Updated: 2026-10-17T08:49:44.653Z
- Topics: TP-Link, Tapo Cameras, IoT Security, Firmware Updates, Home Networks

> Researchers showed hackers on the same home network can chain two flaws to seize full control of TP-Link Tapo C200 and C120 cameras. Firmware fixing six flaws is now available.

## Key takeaways

- TP-Link released firmware fixing six flaws in Tapo C200 V5 and C120 V1 cameras, and the chained-attack research was published October 16, 2026.
- A command-injection flaw chained with a previously disclosed authentication bypass lets an unauthenticated attacker on the same local network run operating system commands on the camera.
- CVE-2026-102369, a remote code execution flaw tied to a diagnostic service, is the most serious issue in the set.
- The chain can give an attacker administrator access without the owner's password, but only from the same local network.
- Owners should update each camera individually in the Tapo app, confirm the latest firmware is running, and change the admin password.

A new TP-Link Tapo camera vulnerability lets someone already on your home Wi-Fi seize full control of certain models. TP-Link has released firmware that fixes six flaws in the affected cameras, and the research went public on October 16, 2026, according to [Cybernews](https://cybernews.com/security/tp-link-tapo-camera-flaw-lets-hackers-seize-full-control-update-urged/). If you own a Tapo C200 V5 or a C120 V1, the update is the first thing to do.

## Which Tapo cameras are affected

The affected models are the Tapo C200 V5 and the Tapo C120 V1. Tapo cameras are sold to American households, so the exposure is broad. Households and small offices that use these models are at risk, and the danger depends as much on the network around the camera as on the camera itself.

OPSWAT's Unit 515 researchers found the newest command-injection flaw, and they described the attack chain in an [OPSWAT blog post](https://www.opswat.com/blog/from-authentication-bypass-to-full-camera-compromise). The same team's earlier work surfaced the bugs that came before. According to [CyberPress](https://cyberpress.org/tp-link-tapo-camera-flaw/), researchers Khoi Tran and Thai Do found those earlier flaws while taking part in OPSWAT's Critical Infrastructure Cybersecurity Graduate Fellowship Program.

## How the two-flaw chain gives full camera control

The attack starts with a command-injection flaw. When it is paired with a previously disclosed authentication bypass, an unauthenticated attacker on the same local network can run operating system commands on the camera, according to [OPSWAT](https://www.opswat.com/blog/from-authentication-bypass-to-full-camera-compromise). In plain terms, the attacker needs a foothold on the network and a way to reach the diagnostic service. The authentication bypass removes the need for the owner's password.

The most serious item is CVE-2026-102369, a remote code execution flaw tied to a diagnostic service. That service exists for manufacturing and maintenance work, and it should not answer requests from a home network. [Quest Review Center](https://questreviewcenter.com/smart-home-tech/tp-link-tapo-camera-flaws-could-give-attackers-control-of-devices-and-a-route-into-home-networks/) reports that, combined with the authentication bypass, the chain can give an attacker administrator-level access without the owner's password.

| Flaw | Type | What it allows |
|---|---|---|
| CVE-2026-102369 | Command injection, remote code execution | Operating system commands through a diagnostic service |
| CVE-2026-15315 | Authentication bypass, CVSS 8.7 | Administrative access without the owner's password |
| CVE-2026-15316 | Denial of service | Interrupts normal camera operation |
| CVE-2026-78578 | Wi-Fi configuration | Unauthorized wireless setting changes and Wi-Fi disconnects |

Every chain in this research requires one condition: the attacker must already be on the same local network. That limit matters, but many home networks put guests, smart plugs and laptops on one flat network, so the condition is easier to meet than it sounds. The risk is highest on shared or poorly segmented Wi-Fi, where a compromised camera can become a foothold for other devices, as [Quest Review Center](https://questreviewcenter.com/smart-home-tech/tp-link-tapo-camera-flaws-could-give-attackers-control-of-devices-and-a-route-into-home-networks/) notes.

A separate flaw, CVE-2026-78578, lets an attacker change wireless settings without permission and can disconnect the camera from Wi-Fi. Its impact is smaller than full takeover, but a camera that drops off the network is one you may not notice has stopped working.

## Why the August patch did not close the gap

TP-Link first disclosed two vulnerabilities in August 2026, CVE-2026-15315 and CVE-2026-15316. It addressed both in firmware V5_1.4.6, released August 18, 2026, as [CyberPress reported](https://cyberpress.org/tp-link-tapo-camera-flaw/) in September. Most coverage of those earlier bugs is two to four weeks old, so the new elements are the chained attack and the October firmware.

The lesson here is about chains. A camera can be patched for one bug and still be exposed when a second flaw supplies the missing step, which is what this research shows. That is a different problem from a single unpatched bug, and it means a fix for one issue does not settle the device's safety.

The Tapo C200 also has a longer record. The [OSV entry for CVE-2021-4045](https://api.osv.dev/v1/vulns/CVE-2021-4045) describes an unauthenticated remote code execution bug that affected firmware 1.1.15 and below and allowed full takeover of the camera. Owners who skipped earlier updates should check their firmware rather than assume the camera is current.

## How to update and secure a Tapo camera

Owners of the affected models can cut their exposure with a short checklist. Work through every camera in your home, because the update applies to each device separately.

- Update each camera's firmware in the Tapo app now, and check each device individually.
- After updating, confirm the camera runs the latest version. Starting an update is not the same as finishing it.
- The sources do not name the firmware that fixes CVE-2026-102369, so install the newest release rather than a specific build number.
- Change the camera's admin password and remove access from accounts you do not recognize.
- Move cameras to a separate guest or IoT network. That limits what a compromised device can reach on your other gear.
- Watch for Wi-Fi drop-offs or settings you did not change, which can point to tampering.

## Is my TP-Link camera hacked? What to look for

The sources reviewed show no confirmed exploitation of these flaws in the wild, and no CISA Known Exploited Vulnerabilities listing for the camera flaws. That is a different picture from [Fortinet's CVE-2025-61624, which CISA flagged as exploited](https://usa-24.com/cve-2025-61624-fortios-attack-patch/), where active attacks were part of the story.

Signs of tampering are ordinary and easy to miss. A camera that repeatedly drops off Wi-Fi, or wireless and admin settings that changed without your input, deserves immediate attention. Update the firmware, change the admin password, and review which accounts still have access before deciding the camera is safe.

Connected devices keep drawing attention from attackers, as hackers showed when they [overheated French supermarket fridges](https://usa-24.com/french-supermarket-fridge-hack/). A camera on the same network as a laptop or phone deserves the same basic hygiene.

## What to watch next for Tapo camera owners

Several questions remain open. The sources do not give a CVSS score for CVE-2026-102369, and they do not identify which firmware fixes it. It is also unknown whether TP-Link will issue further disclosures or a broader response.

The local-network requirement is the most important variable. If future research shows a way to reach these cameras without that foothold, the risk shifts from a home network problem to something much wider. Compared with the August and September coverage, the October research moves the story from single bugs to a demonstrated attack path, which changes what owners should do.

For now, the job is simple: update every affected camera, confirm the version, and keep it on a segmented network. Watch for TP-Link's own advisory and any follow-up from OPSWAT's Unit 515 team, since either could answer the open firmware question.

## Frequently asked questions

### Which Tapo cameras are affected by the latest flaws?

The research covers the Tapo C200 V5 and the Tapo C120 V1. TP-Link has released firmware updates that fix six flaws across those models. Owners should install the latest firmware on each camera and confirm the version afterward.

### Can someone hack my Tapo camera from the internet?

According to the sources, the chain requires the attacker to already be on the same local network, so it is not an internet-only attack. That condition could change with future research. Placing cameras on a guest or IoT network reduces what a compromised device can reach.

### Has CVE-2026-102369 been exploited in the wild?

The sources reviewed show no evidence of in-the-wild exploitation, and the camera flaws are not listed in CISA's Known Exploited Vulnerabilities catalog. The sources also do not give a CVSS score or name the firmware that fixes the flaw. Installing the latest firmware is the safest response.

### How do I know if my TP-Link camera has been tampered with?

Watch for Wi-Fi drop-offs and settings you did not change, because the flaws can disconnect a camera from Wi-Fi and alter wireless settings. If you see either, update the firmware, change the admin password, and remove access from unfamiliar accounts.

## Sources

1. [TP-Link Tapo camera flaw lets hackers seize full control – update urged, Cybernews](https://cybernews.com/security/tp-link-tapo-camera-flaw-lets-hackers-seize-full-control-update-urged/)
2. [From Authentication Bypass to Full Camera Compromise, OPSWAT blog](https://www.opswat.com/blog/from-authentication-bypass-to-full-camera-compromise)
3. [TP-Link Tapo camera flaws could give attackers control of devices and a route into home networks, Quest Review Center](https://questreviewcenter.com/smart-home-tech/tp-link-tapo-camera-flaws-could-give-attackers-control-of-devices-and-a-route-into-home-networks/)
4. [TP-Link Tapo C200 Has Critical Flaws That Could Let Hackers Spy on You, Android Headlines](https://www.androidheadlines.com/2026/09/tp-link-tapo-c200-has-critical-flaws-that-could-let-hackers-spy-on-you.html)
5. [TP-Link Tapo Camera Flaw Lets Attackers Gain Admin Access Without Password, CyberPress](https://cyberpress.org/tp-link-tapo-camera-flaw/)
6. [CVE-2021-4045 record, OSV](https://api.osv.dev/v1/vulns/CVE-2021-4045)