A new TP-Link Tapo camera vulnerability lets someone already on your home Wi-Fi seize full control of certain models. TP-Link has released firmware that fixes six flaws in the affected cameras, and the research went public on October 16, 2026, according to Cybernews. If you own a Tapo C200 V5 or a C120 V1, the update is the first thing to do.
Which Tapo cameras are affected
The affected models are the Tapo C200 V5 and the Tapo C120 V1. Tapo cameras are sold to American households, so the exposure is broad. Households and small offices that use these models are at risk, and the danger depends as much on the network around the camera as on the camera itself.
OPSWAT's Unit 515 researchers found the newest command-injection flaw, and they described the attack chain in an OPSWAT blog post. The same team's earlier work surfaced the bugs that came before. According to CyberPress, researchers Khoi Tran and Thai Do found those earlier flaws while taking part in OPSWAT's Critical Infrastructure Cybersecurity Graduate Fellowship Program.
How the two-flaw chain gives full camera control
The attack starts with a command-injection flaw. When it is paired with a previously disclosed authentication bypass, an unauthenticated attacker on the same local network can run operating system commands on the camera, according to OPSWAT. In plain terms, the attacker needs a foothold on the network and a way to reach the diagnostic service. The authentication bypass removes the need for the owner's password.
The most serious item is CVE-2026-102369, a remote code execution flaw tied to a diagnostic service. That service exists for manufacturing and maintenance work, and it should not answer requests from a home network. Quest Review Center reports that, combined with the authentication bypass, the chain can give an attacker administrator-level access without the owner's password.
| Flaw | Type | What it allows |
|---|---|---|
| CVE-2026-102369 | Command injection, remote code execution | Operating system commands through a diagnostic service |
| CVE-2026-15315 | Authentication bypass, CVSS 8.7 | Administrative access without the owner's password |
| CVE-2026-15316 | Denial of service | Interrupts normal camera operation |
| CVE-2026-78578 | Wi-Fi configuration | Unauthorized wireless setting changes and Wi-Fi disconnects |
Every chain in this research requires one condition: the attacker must already be on the same local network. That limit matters, but many home networks put guests, smart plugs and laptops on one flat network, so the condition is easier to meet than it sounds. The risk is highest on shared or poorly segmented Wi-Fi, where a compromised camera can become a foothold for other devices, as Quest Review Center notes.
A separate flaw, CVE-2026-78578, lets an attacker change wireless settings without permission and can disconnect the camera from Wi-Fi. Its impact is smaller than full takeover, but a camera that drops off the network is one you may not notice has stopped working.
Why the August patch did not close the gap
TP-Link first disclosed two vulnerabilities in August 2026, CVE-2026-15315 and CVE-2026-15316. It addressed both in firmware V5_1.4.6, released August 18, 2026, as CyberPress reported in September. Most coverage of those earlier bugs is two to four weeks old, so the new elements are the chained attack and the October firmware.
The lesson here is about chains. A camera can be patched for one bug and still be exposed when a second flaw supplies the missing step, which is what this research shows. That is a different problem from a single unpatched bug, and it means a fix for one issue does not settle the device's safety.
The Tapo C200 also has a longer record. The OSV entry for CVE-2021-4045 describes an unauthenticated remote code execution bug that affected firmware 1.1.15 and below and allowed full takeover of the camera. Owners who skipped earlier updates should check their firmware rather than assume the camera is current.
How to update and secure a Tapo camera
Owners of the affected models can cut their exposure with a short checklist. Work through every camera in your home, because the update applies to each device separately.
- Update each camera's firmware in the Tapo app now, and check each device individually.
- After updating, confirm the camera runs the latest version. Starting an update is not the same as finishing it.
- The sources do not name the firmware that fixes CVE-2026-102369, so install the newest release rather than a specific build number.
- Change the camera's admin password and remove access from accounts you do not recognize.
- Move cameras to a separate guest or IoT network. That limits what a compromised device can reach on your other gear.
- Watch for Wi-Fi drop-offs or settings you did not change, which can point to tampering.
Is my TP-Link camera hacked? What to look for
The sources reviewed show no confirmed exploitation of these flaws in the wild, and no CISA Known Exploited Vulnerabilities listing for the camera flaws. That is a different picture from Fortinet's CVE-2025-61624, which CISA flagged as exploited, where active attacks were part of the story.
Signs of tampering are ordinary and easy to miss. A camera that repeatedly drops off Wi-Fi, or wireless and admin settings that changed without your input, deserves immediate attention. Update the firmware, change the admin password, and review which accounts still have access before deciding the camera is safe.
Connected devices keep drawing attention from attackers, as hackers showed when they overheated French supermarket fridges. A camera on the same network as a laptop or phone deserves the same basic hygiene.
What to watch next for Tapo camera owners
Several questions remain open. The sources do not give a CVSS score for CVE-2026-102369, and they do not identify which firmware fixes it. It is also unknown whether TP-Link will issue further disclosures or a broader response.
The local-network requirement is the most important variable. If future research shows a way to reach these cameras without that foothold, the risk shifts from a home network problem to something much wider. Compared with the August and September coverage, the October research moves the story from single bugs to a demonstrated attack path, which changes what owners should do.
For now, the job is simple: update every affected camera, confirm the version, and keep it on a segmented network. Watch for TP-Link's own advisory and any follow-up from OPSWAT's Unit 515 team, since either could answer the open firmware question.
