Two critical security vulnerabilities identified in the globally deployed TP-Link Tapo C200 smart indoor security camera enable attackers positioned on the same local network to seize total administrative control of the device without providing valid credentials. Tracked under designations CVE-2026-15315 and CVE-2026-15316, the flaws were discovered and verified by cybersecurity researchers Khoi Tran and Thai Do of OPSWAT Unit 515 during a critical infrastructure security fellowship. The flaws permit adversaries to alter device configurations, disable local video recording, cause device reboot loops, and intercept private audiovisual camera feeds in real time.
The Tapo C200 pan-and-tilt Wi-Fi camera is widely deployed across millions of residences, small businesses, and medical clinics for remote monitoring. While the device is engineered to communicate with TP-Link's cloud infrastructure, it simultaneously exposes local HTTP and network services to handle local setup, diagnostics, and real-time streaming protocol (RTSP) audiovisual feeds.
According to OPSWAT's advisory, the primary vulnerability, CVE-2026-15315, exists within the camera's local API authentication dispatch mechanism. When client applications submit control commands to the device's local control port, the firmware fails to enforce cryptographic token verification on select management endpoints. By structuring a specific JSON control packet, an unauthenticated attacker on the local network can bypass the authentication gate. This grants the attacker administrative rights to reconfigure Wi-Fi parameters, reposition camera viewing angles, enable unauthenticated RTSP stream transmission, and eavesdrop on sensitive conversations within the physical space.
The second vulnerability, CVE-2026-15316, is a severe memory corruption vulnerability in the camera's HTTP management daemon. Transmitting an oversized, malformed packet triggers a buffer overflow that crashes the core management service, forcing the device into a persistent reboot loop. This enables malicious actors to blind security cameras prior to conducting physical intrusions.
Hardening Actions and Immediate Remediation
- Deploy Latest Firmware Updates Immediately: Open the TP-Link Tapo mobile application, navigate to `Device Settings -> Device Info -> Firmware Update`, and apply all pending security releases.
- Segment IoT Devices on Dedicated VLANs: Segregate home automation hardware, IP cameras, and smart sensors onto an isolated Virtual Local Area Network (VLAN) to prevent lateral movement from guest networks.
- Disable Universal Plug and Play (UPnP): Verify that router configurations have UPnP disabled to eliminate automatic port-forwarding of camera management ports to the public internet.
Forensic Investigation and Threat Hunting Indicators
Security analysts and network administrators investigating potential compromise should monitor the following network artifacts:
1. Telemetry on Local RTSP Connections: Inspect local routing logs for unauthorized connections to camera RTSP ports (port 554 or 8554) originating from non-management endpoints. 2. Inspect Malformed HTTP POST Requests: Check firewall and packet capture telemetry for abnormal JSON payloads addressed to the camera's internal control ports. 3. Monitor Device Availability Anomalies: Rapid and recurring camera disconnection events may signal active exploitation of the CVE-2026-15316 denial-of-service vector.