Six security flaws were fixed in two popular TP-Link Tapo cameras — and the worst one can hand an attacker full control of the device. Check whether yours is exposed.
What happened
Security researchers at OPSWAT (Khoi Tran and Thai Do, Unit 515) found six flaws in the TP-Link Tapo C200 V5 and Tapo C120 V1 security cameras. TP-Link has released firmware updates fixing all six. Four of the flaws were publicly identified (paraphrased from Cybernews' October 16, 2026 reporting):
CVE-2026-102369 (severe) — command injection in a diagnostic service used for camera maintenance and manufacturing. The service builds operating-system commands out of user input without adequate validation, so specially crafted file-transfer instructions get executed as OS commands on the camera.
CVE-2026-78578 (high) — a Wi-Fi configuration flaw that lets an attacker change the camera's Wi-Fi settings without logging in, knocking it off the network.
CVE-2026-78577 — unauthenticated disclosure of nearby Wi-Fi network names, device identifiers, and security settings.
CVE-2026-9032 (high) — unauthenticated attackers can crash the camera's HTTPS service.
The remaining two of the six flaws were not publicly identified in the reporting — treat them as undisclosed, not as absent.
How the attack works (in plain language)
The researchers demonstrated the full chain in a lab:
Same-network access first. The attacker must already be on your local network (your Wi-Fi) — this is not a remote attack from the internet.
Admin without the password. Using an earlier authentication-bypass flaw (disclosed in August, reported in September), the attacker gains administrator access without knowing your camera's password.
Wake the hidden tool. They enable the camera's hidden diagnostic service and restart the device.
Inject commands. Through the severe command-injection flaw, they run operating-system commands on the camera itself.
At that point it's full takeover: run any OS command, install malware, keep persistent access — and use the camera as a foothold to scan and attack other devices on your network.
Honest limits — read this part
The full attack chain was demonstrated in a lab, not observed in real attacks.
There is no evidence of in-the-wild exploitation.
The attacker must be on your local network — a stranger across the internet cannot do this directly.
Firmware fixes for all six flaws have been released — updating closes the door.
This is a "patch promptly" situation, not a "throw the camera away" one.
What to do NOW
Update the firmware today. Open the Tapo app → select the camera → device settings → check for firmware updates. Install anything offered.
Change the camera's password from anything default or reused. Use the Tapo app's account/device password settings.
Isolate the camera. Put smart cameras on a guest or dedicated IoT network segment, separate from your computers and phones — so a compromised camera can't reach them.
Audit your network. Check your router's device list for anything you don't recognize. Unknown devices get removed.
Re-check after updating. Confirm the firmware version in the Tapo app matches the latest TP-Link release for your model.
FROM INGENIOUS AI
One vulnerable gadget is all an attacker needs as a foothold. Our free checkers cover the rest of your digital life: scams, breaches, passwords, and AI risks.
Answer honestly. This checks your exposure habits, not the camera's firmware directly.
Cybersecurity FAQ
Which TP-Link Tapo cameras are affected?
The Tapo C200 V5 and Tapo C120 V1. TP-Link has released firmware updates fixing all six flaws — update via the Tapo app as soon as you can.
What is CVE-2026-102369?
A severe command-injection flaw in the camera's diagnostic service: it builds operating-system commands from user input without adequate validation, so crafted file-transfer instructions run as commands on the camera itself.
Can hackers take over my camera from the internet?
The lab-demonstrated chain needs the attacker on your local network first. They use an earlier auth bypass to get admin access, switch on the hidden diagnostic tool, restart the camera, and inject commands. No real-world attacks have been reported.
How do I protect my Tapo camera?
Update the firmware immediately, set a unique password, move the camera to a separate guest/IoT network, and check your router's device list for anything unfamiliar.
Honest scope
This page summarizes reporting on the flaws; it is not a substitute for TP-Link's official security advisory.
The attack chain was lab-demonstrated; no in-the-wild exploitation has been reported.
Two of the six fixed flaws were not publicly identified — the page does not invent details for them.
Updating firmware is the fix. Everything else here reduces blast radius, it does not replace the patch.
Source: Ann-Marie Corvin, "TP-Link Tapo camera flaw lets hackers seize full control – update urged", Cybernews, Oct 16, 2026 (summarized, not quoted).