What vulnerabilities affect TP-Link Tapo C200 and C120 cameras?
Two significant security flaws have been identified in TP-Link's Tapo C200 and C120 home security cameras. The primary issue is a login bypass vulnerability that allows anyone connected to the same local network to gain administrator-level access without a password. This access includes viewing live video streams, stored recordings, and modifying device settings. A second flaw, affecting only the C200, can cause the device to crash or reboot by sending oversized encrypted Wi-Fi credential data, disrupting monitoring capabilities.
How do these vulnerabilities impact users?
The combination of login bypass and crash vulnerabilities means that an attacker on the same Wi-Fi network could spy on users through the cameras, accessing sensitive footage like baby monitoring and pet surveillance, without needing the owner's credentials. Additionally, the crash flaw could lead to denial-of-service, preventing users from controlling or viewing their cameras until the device recovers. This poses significant privacy and security risks within otherwise trusted home or office networks. The risks are somewhat limited by the requirement for network access but remain serious for affected users.
What should TP-Link camera users do now?
Owners of Tapo C200 and C120 cameras should immediately update their devices to the latest firmware released by TP-Link, which patches the known vulnerabilities. Users should verify the firmware version via the camera management app or TP-Link support to ensure they are protected. Since attackers must be on the same network to exploit these issues, it is also advisable to secure home Wi-Fi with strong passwords and network segmentation to isolate IoT devices. Monitoring for any unusual device activity and limiting network access can further reduce exposure.
Are there any remaining risks after updating firmware?
While current firmware updates address the identified flaws, there remains an undisclosed critical vulnerability discovered by researchers that could allow full compromise of the cameras, potentially serving as a foothold for attackers inside the network. No public patch or timeline has been released for this issue yet. Users should stay alert to further updates from TP-Link and maintain vigilant network security practices. Until the final patch is available, assume some residual risk remains.
Key takeaway for TP-Link Tapo camera users
If you own Tapo C200 or C120 cameras, promptly updating to the latest firmware is essential to prevent unauthorized access to your camera feed and recordings. Given the nature of these vulnerabilities, network-level security measures and regular firmware maintenance are critical to protect your privacy and security. Stay informed about future patches that address all known vulnerabilities, and ensure your smart home devices are not providing easy entry points for attackers.