Cybersecurity company OPSWAT said the vulnerabilities, tracked as CVE-2026-15315 and CVE-2026-15316, were identified during research into the Tapo C200 security camera. TP-Link has issued firmware fixes for affected models and urged users to install the latest available updates.
The more serious flaw, CVE-2026-15315, is an authentication bypass involving its local management interface. OPSWAT said an attacker with network access could replay parts of the authentication exchange and obtain a valid administrative session without knowing or recovering the user’s password.
Administrative access could allow an attacker to change device settings and use management functions restricted to an authorised administrator. OPSWAT said that level of access could expose privacy-sensitive functions, including live streams and stored recordings, creating a risk of unauthorised surveillance.
TP-Link rates CVE-2026-15315 as high severity, with a CVSS 4.0 score of 8.7. Its advisory says the weakness affects Tapo C120 hardware version 1 and Tapo C200 hardware version 5, where challenge-parameter weaknesses allow a local-network attacker to bypass normal authentication controls and obtain session tokens.
The second vulnerability, CVE-2026-15316, affects the Tapo C200 version 5 and concerns inadequate validation of encrypted credential data during configuration. OPSWAT said an attacker with network access can submit an oversized encrypted credential value, causing malformed data to reach a vulnerable processing path.
That condition can crash its HTTPS service and trigger a denial-of-service condition. TP-Link said oversized encrypted ciphertext values may cause exception-handling failures, forcing it to crash or restart, temporarily interrupting HTTPS management and monitoring until the service recovers.
TP-Link has assigned CVE-2026-15316 a CVSS 4.0 score of 7.1, also classed as high. The company’s advisory lists fixed firmware as version 1.9.3 Build 260521 for the Tapo C120 V1 and V5_1.4.6 Build 260709 Rel.27675n for the Tapo C200 V5.
The authentication weakness arises from the camera’s challenge-and-response process over its local HTTPS management interface. Normally, the camera generates a challenge and expects a response derived from the user’s password before creating an authenticated session. OPSWAT found an alternative path in which a value returned by the camera during the exchange could, under certain conditions, be reused and accepted later, removing the need for the attacker to prove knowledge of the password.
OPSWAT said no existing authenticated session is required and the bypass can be completed with only a small number of requests to the local interface. The company deliberately withheld implementation-level details that could make exploitation easier.
The researchers also said their examination identified additional security issues beyond the two disclosed flaws, including a more serious vulnerability that could permit full control of a camera and potentially allow a compromised device to serve as a foothold inside a network. OPSWAT said that issue remains under coordinated disclosure with TP-Link and has not published technical details while remediation work continues.
OPSWAT researchers Khoi Tran and Thai Do reported the vulnerabilities to TP-Link on April 16. TP-Link confirmed the findings on July 10 and began work on fixes, while the CVE identifiers were assigned on August 13. The company’s advisory was updated on August 27.
The disclosure is significant because the affected devices are internet-connected cameras used in homes and small businesses, where compromise of administrative controls can carry direct privacy consequences. The eavesdropping risk stems from the authentication bypass rather than the oversized-credential flaw, which is designed to disrupt availability.
Neither OPSWAT nor TP-Link has publicly stated that the vulnerabilities were being exploited in the wild. The researchers demonstrated the security impact in a proof-of-concept under controlled laboratory conditions.
TP-Link recommends affected customers update their cameras to the latest firmware. Devices that remain on vulnerable versions may continue to be exposed to the authentication bypass or denial-of-service weakness, depending on model and hardware revision.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
