Security researchers have uncovered serious vulnerabilities in two of the best-selling indoor security cameras on the market: the TP-Link Tapo C200 and C120 models. These affordable cameras, priced around $26.99 for the C200 and selling thousands of units monthly, are popular choices for home monitoring, baby watching, and pet surveillance. However, cybersecurity experts warn that the vulnerabilities could allow unauthorized access to live video feeds and stored recordings without requiring a password.
How the Security Flaws Work
Researchers at OPSWAT discovered two high-severity vulnerabilities that expose users to potential privacy breaches. The most serious flaw allows anyone connected to the same home Wi-Fi network to gain administrator access to the camera without knowing the owner’s password. This means a visitor, neighbor, or anyone else on your network could potentially view live video, access night vision feeds, monitor two-way audio, and download stored footage.
The vulnerability exists because of a flaw in the camera’s login verification process. The Tapo C200 and C120 use a challenge-response authentication system designed to confirm that someone knows the correct password. However, researchers found a second verification path where the camera could be tricked into accepting improper authentication responses, granting full admin access after just a small number of requests.
The second vulnerability affects only the C200 and involves its Wi-Fi setup process. An attacker could send specially crafted data to crash the camera’s security service or force it to restart, disconnecting the owner from management and monitoring capabilities temporarily.
What This Means for Current Owners
The good news is that TP-Link has already released firmware updates that patch both known vulnerabilities. Users of the C200 and C120 should update their cameras immediately through the device’s app or web interface. Both cameras have received patches rated as “high severity” with vulnerability scores of 8.7 and 7.1 respectively.
However, there’s a complication: researchers have discovered an additional critical vulnerability that hasn’t been disclosed publicly yet. This third flaw could potentially allow complete compromise of the camera and create a gateway for attackers to access your home network. OPSWAT is withholding publication of this vulnerability’s details while waiting for TP-Link to release a patch, but no timeline has been announced for when consumers will see that update.
Important Limitations to Understand
While these vulnerabilities are serious, they do have some scope limitations. An attacker would need to be on the same Wi-Fi network or within a trusted ecosystem to exploit these flaws. This means strangers on the internet cannot remotely access your camera, but household members, guests, or people within range of your Wi-Fi could potentially do so. If you share your network password or have guests connect to your Wi-Fi, the risk increases.
For users concerned about security, exploring alternatives like cameras that eliminate subscription requirements might be worth considering. Additionally, some newer models now include physical privacy shutters to provide extra peace of mind.
Steps You Should Take Today
If you own a Tapo C200 or C120 camera, take these actions immediately:
- Update your camera firmware to the latest version available through the TP-Link Tapo app
- Change your camera’s administrator password to a strong, unique credential
- Review your Wi-Fi network security and consider using a guest network for visitors
- Check your camera’s access logs to see if there have been any unauthorized login attempts
- Monitor TP-Link’s security advisories for the pending critical patch
For shoppers currently in the market for an indoor security camera, this situation highlights the importance of choosing devices from manufacturers with strong security track records and responsive vulnerability disclosure practices. Researching well-reviewed options that prioritize privacy and security features can help you make a more informed purchase decision.
The smart home security market continues to evolve, and staying informed about vulnerabilities and patches is essential for protecting your family’s privacy. While the Tapo cameras remain popular due to their affordable price point, this incident demonstrates that cost should never be your only consideration when choosing a device that monitors your home and loved ones.
