| TP-Link Tapo C210
|
|
Security Grade
Calculator v1
|
TP-Link Tapo C210
Category: Smart Camera • Model / Gen: Tapo C210 (2K 3MP, v1)
Release Date: 2021-03-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Physically proximate root access has been demonstrated on the sibling C200 (CVE-2022-41505) via the UART/debug interface; no dedicated mass-tampering case for the C210.
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
C210 has a password-recovery authentication bypass (CVE-2023-35717, CVSS 8.8); the Tapo camera line also carries an unauthenticated RCE in the C200 (CVE-2021-4045, CVSS 9.8) and reusable AES key material (CVE-2023-27126).
|
| Prior attacks
|
Rare
|
🔗 Proof
|
No Tapo model appears in the CISA KEV catalog and no public campaign targeting C210 specifically was found.
|
| Updatability
|
Very common
|
🔗 Proof
|
Firmware is delivered over the air through the Tapo app, with downloadable firmware and a public support/FAQ knowledge base.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Bound to a TP-Link ID cloud account and paired to the app; third-party integration exists through RTSP/ONVIF with separate local credentials.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Cloud traffic uses TLS and the app enforces certificate validation; local RTSP is unencrypted but disabled unless the user enables it.
|
| Storage
|
Encrypted with obselete encryption
|
🔗 Proof
|
microSD recordings are stored unencrypted; the C200 was found reusing a single AES key/IV pair across devices (CVE-2023-27126), so on-device crypto cannot be rated current.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
🔗 Proof
|
Account creation, password reset, device sharing with per-user roles and session management are all handled by the Tapo cloud account.
|
| Authentication
|
Basic
|
🔗 Proof
|
Cloud password authentication with optional e-mail verification codes; no hardware-backed or TOTP second factor on the camera itself.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
Cloud login has rate limiting, but the device-side password-recovery flow that CVE-2023-35717 bypassed shows protection is not uniform.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
The app shows motion/alert history and device activity, but there is no user-facing authentication audit log.
|
| Passwords
|
Require change after setup with complexity requirements
|
🔗 Proof
|
TP-Link ID enforces a minimum length plus mixed character classes; the device Wi-Fi/RTSP password must be set during onboarding.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Tapo embedded Linux firmware (Companion App: Tapo app (Android/iOS))
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage: microSD card up to 512 GB, Tapo Care cloud
|
| Power, Battery & Charging
|
Battery: • Power: 9 V DC adapter • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: 2.4 GHz Wi-Fi (802.11n), RTSP/ONVIF (local)
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Reasoning: The C210 is a mainstream consumer pan/tilt camera with a decent cloud security baseline (TLS, account lifecycle, OTA updates) but a young and still-growing CVE record, including an authentication bypass specific to this model and a reused AES key/IV finding on its predecessor. Local recordings are not encrypted at rest, and the device-side recovery flow has been the weakest link. Scope note: assessment covers stock firmware with cloud mode; enabling RTSP/ONVIF exposure or disabling updates would lower the rating. Release date is the v1 launch (year/month level precision).
