Key findings
| Item | Detail |
|---|---|
| Affected products | Tapo C200 V5 and Tapo C120 V1 home cameras |
| Attack position | Same local network, no credentials and no user interaction |
| Worst outcome | Arbitrary OS commands as the camera's service user |
| Fix | Firmware V5_1.4.6. Update through the Tapo app. |
The issues sit in different services, so none of them looks critical on its own. Together they turn a device on the guest Wi-Fi into a foothold with a live microphone and camera.
| CVE | Severity | Finding |
|---|---|---|
| CVE-2026-102369 | High · 8.7 | Command injection in the MacTool handler of the TMPD service |
| CVE-2026-15315 | High · 8.7 | Authentication bypass via replay in the local management interface |
| CVE-2026-15316 | Medium · 6.5 | Insufficient input validation during Wi-Fi onboarding |
How we found the chain
We started from the local management interface that the mobile app uses during setup. Its login is a challenge-response exchange, which is sound in principle, but the camera accepted a response it had already seen.
Some related findings are still under coordinated disclosure with the vendor and are left out of this post.
Inside the chain
Replaying the login
The camera derived its challenge from values that repeat across sessions. A response captured once on the network stayed valid, so an attacker could present it again and receive an admin session without the password.
Crashing onboarding
During Wi-Fi onboarding the HTTPS service trusted the length of a field it parsed. An oversized value stopped the service, which forced the camera back into a state where setup traffic was easier to observe.
Injecting commands
With an admin session, the diagnostic handler accepted a network tool name that was passed to a shell. Adding a separator to that name ran a second command of our choosing.
Attack chain
Local network
The attacker reaches the camera's management port.
Replay
A captured login response yields an admin session.
Inject
The diagnostic handler passes input to a shell.
Control
Commands run on the camera with access to video and audio.
Unit 515 verdict
Each flaw needs the one before it, but none needs a password or user interaction. On a shared network, this is a reliable path to full device control.
Disclosure timeline
Apr 16, 2026
Unit 515 reports the replay and onboarding issues to TP-Link.
Jul 10, 2026
TP-Link confirms both findings and starts work on a fix.
Aug 18, 2026
Firmware V5_1.4.6 ships; CVE-2026-15315 and CVE-2026-15316 are published.
Oct 1, 2026
The command injection is fixed and published as CVE-2026-102369.
Remediation
Update to the fixed firmware first. The steps below reduce exposure for any camera of this class:
- Keep cameras off networks shared with guests or untrusted devices
- Restrict the management interface to the devices that set the camera up
- Turn on automatic firmware updates in the vendor app
Models we tested or confirmed as affected:
- Tapo C200 V5
- Tapo C120 V1