TP-Link Cameras 0-Day Vulnerabilities Allow Attackers to Spy on Users
Two zero-day flaws in TP-Link Tapo C200 cameras allowed authentication bypass and denial-of-service; fixed in firmware V5_1.4.6.
OPSWAT researchers Khoi Tran and Thai Do found CVE-2026-15315, an authentication bypass in the Tapo C200's local HTTPS interface that lets network-adjacent attackers replay an authentication value to gain administrator access, and CVE-2026-15316, an unauthenticated denial-of-service in the Wi-Fi onboarding process that crashes the camera's HTTPS service. TP-Link was notified on April 16, 2026, confirmed the flaws on July 10, and released patches on August 18, 2026 in firmware V5_1.4.6. Exploitation requires local network access but no valid account, existing session, or user interaction, exposing live feeds and stored recordings to surveillance risk.
- CVE-2026-15315: authentication bypass via replay in local HTTPS challenge-response, granting admin access without the password
- CVE-2026-15316: oversized encrypted Wi-Fi credentials crash the HTTPS service, an unauthenticated denial-of-service
- Patched in firmware V5_1.4.6 released August 18, 2026; users should update immediately
- Admin access can expose live feeds and recordings, creating surveillance and privacy risk
- Products
- Tapo C200
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-15315 | Authentication Bypass via Challenge Validation Flaw in TP-Link Tapo C120/C200 Cameras | 8.7 | <1% | PoC | |
| CVE-2026-15316 | Unauthenticated Input Validation DoS in TP-Link Tapo C200 v5 Configuration Service | 7.1 | <1% |
From the original article
3 min read at cybersecuritynews.com
TP-Link Tapo C200 smart cameras were affected by two zero-day vulnerabilities that could allow attackers on the same network to bypass authentication or disrupt camera services. The flaws, tracked as CVE-2026-15315 and CVE-2026-15316, were fixed in firmware version V5_1. 4.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.