MANILA, September 20 — Security researchers have uncovered vulnerabilities in a popular budget home surveillance camera, and the company behind it has already moved to fix them. The US cybersecurity vendor OPSWAT found the flaws in TP-Link’s Tapo C200, an affordable indoor camera sold at retailers including Amazon and widely used as a baby or pet monitor, letting customers watch live footage through a mobile app.
The most serious finding is a “critical” flaw that, according to OPSWAT, can “allow an attacker to fully compromise the camera and use the compromised device as a foothold within the network.” OPSWAT has not revealed further details about that critical vulnerability, including whether exploiting it requires local access to the camera’s internet network. The firm says it continues “to work closely with TP-Link on validation and remediation” of the flaw.
Two more flaws, one built for spying
Beyond the critical issue, OPSWAT researchers examined the product’s firmware and local communication processes and discovered two other software-related vulnerabilities, one of which could be used for spying. That flaw requires the hacker to have already obtained local access to the owner’s internet network. It is tracked as CVE-2026-15315 and, per OPSWAT, can let an attacker “obtain a valid admin session without the password” by exploiting an alternative authentication path.
“Once authenticated, the attacker gains access to management functionality normally restricted to the camera administrator, allowing unauthorized changes to the device’s configuration and other privileged operations,” the company added. The second flaw, CVE-2026-15316, can knock the camera offline.
According to the official vulnerability description, “An attacker can send oversized crypted ciphertext values that may trigger exception handling failures, due to insufficient validation, causing the affected device to crash or restart.” Like the spying flaw, it requires local network access to the camera.
Patch out, and a nudge to update
TP-Link did not immediately respond to a request for comment, but the company patched the two flaws last month by releasing a new firmware build for the Tapo C200 that users can download and update to. The flaws also affect another camera, the Tapo C120, which has received updated firmware as well. Installing the new firmware can be done through the Tapo mobile app.
In an update, TP-Link told PCMag that the company “takes the security of our products and the privacy of our customers very seriously. Upon being notified by independent security researchers of vulnerabilities affecting certain smart home products, specifically Tapo C200 camera, our product security team immediately investigated the findings and developed firmware updates to address the reported issues.” The company added: “The affected vulnerabilities have been remediated for Tapo C200 V5.
We strongly encourage all customers to ensure their devices are running the latest firmware version, available through the Tapo app,” and said “TP-Link is committed to responsible vulnerability disclosure and continues to work closely with the research community to review and address reported security findings.” For households across the region that rely on these cameras to keep an eye on a sleeping child, a pet, or a front door, the practical step is a simple one: open the Tapo app and check that the firmware is current.
What to watch next is whether OPSWAT releases fuller technical detail on the critical flaw, and whether the fix holds up under independent scrutiny.
