Loading story…
TP-Link patched two vulnerabilities in its Tapo C200 smart cameras that allow attackers on the same network to hijack an administrative session or disrupt the camera's HTTPS service. CVE-2026-15315 allows replay of camera-generated authentication material in the local HTTPS management interface, potentially exposing live video, stored recordings, and administrative functions without the camera password. CVE-2026-15316 allows an unauthenticated attacker to send an oversized encrypted Wi-Fi credential during onboarding and crash the HTTPS service.
OPSWAT reported the issues to TP-Link on April 16; TP-Link confirmed them on July 10, assigned CVEs on August 13, and released the remediation in Tapo C200 firmware V5_1.4.6 on August 18. OPSWAT also disclosed that it reported a separate critical, currently undisclosed flaw that could fully compromise a camera and establish a foothold on the local network; technical details remain withheld pending a fix.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
TP-Link released Tapo C200 firmware V5_1.4.6, fixing CVE-2026-15315 and CVE-2026-15316. The flaws could respectively enable a network attacker to obtain an administrative session or crash the camera's HTTPS service.
TP-Link assigned CVE-2026-15315 to the local HTTPS authentication-bypass issue and CVE-2026-15316 to the oversized encrypted-credential denial-of-service issue.
TP-Link confirmed OPSWAT's findings for the two Tapo C200 vulnerabilities, including the replay-based administrative-session bypass and HTTPS-service denial of service.
OPSWAT researchers reported the authentication-bypass flaw CVE-2026-15315 and Wi-Fi onboarding denial-of-service flaw CVE-2026-15316 affecting TP-Link Tapo C200 cameras to TP-Link.
OPSWAT reported a separate undisclosed critical zero-day in TP-Link cameras that could reportedly permit full camera compromise and provide a foothold on the local network. OPSWAT and TP-Link are working on a fix, with technical details withheld pending remediation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourceinfosecurity-magazine.com
Open sourceopswat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TP-Link has patched two vulnerabilities in **Kasa EC70 v4** and **EC71 v4** cameras, including the high-severity **`CVE-2026-9770`** flaw caused by a hardcoded private cryptographic key embedded in firmware. Because the same static key was stored in a read-only filesystem and shared across devices, an unauthenticated attacker on the same local network could extract it from the firmware image and use it against the cameras’ web management service, undermining the confidentiality of encrypted communications. The issue could enable passive traffic decryption, machine-in-the-middle interception, and capture of administrative credentials. TP-Link also fixed **`CVE-2026-13230`**, a lower-severity information disclosure bug that can reveal geolocation data through the devices’ local discovery mechanism without authentication. The affected products are vulnerable on firmware versions earlier than **2.4.0 Build 20260520 rel.4191**, and the company said it has found no evidence of active exploitation or any public proof-of-concept. Because both flaws require local network access, the exposure is most relevant to shared Wi-Fi environments or compromised devices already inside the network; users are advised to update camera firmware and the Kasa mobile app and to isolate IoT devices on a guest or segmented network.
Jul 17, 2026
Security researcher Spaceraccoon disclosed an exploit chain affecting the TP-Link Tapo C260 camera that can be used to gain a shell on the device. The chain ties together **CVE-2026-0651**, **CVE-2026-0652**, and **CVE-2026-0653**, and public reporting describes the issues as enabling remote code execution against the webcam. A companion GitHub repository published by `l0lsec` provides a proof-of-concept implementation based on the research. The public release of both the technical write-up and exploit code lowers the barrier for attackers targeting exposed or reachable Tapo C260 devices. For defenders, the disclosure means organizations and consumers using the camera should urgently identify affected deployments, restrict network exposure, monitor for signs of compromise, and apply any vendor fixes or mitigations as they become available.
Jul 12, 2026
TP-Link disclosed **CVE-2026-76784**, a high-severity vulnerability (CVSS v4.0 **8.7**) in the local communications protocol used by multiple Kasa smart-home devices. Insufficient cryptographic protections allow an attacker on the same local or wireless network to intercept, replay, or forge device-control messages without authentication, privileges, or user interaction, potentially affecting smart plugs, switches, lights, and related products. An attacker could change device states without authorization, disrupt connected appliances, or cause denial-of-service conditions. TP-Link has issued model-specific firmware updates through the Kasa application; users should install the update applicable to their exact hardware version and isolate IoT devices from guest and less-trusted networks until remediation is complete. No confirmed exploitation in the wild or public proof of concept has been reported.
Aug 27, 2026