| TP-Link Tapo C200 (V3)
|
|
Security Grade
Calculator v
|
TP-Link Tapo C200 (V3)
Release Date: 2019-09-03 • Status:
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
ASSESSOR INFERENCE: Rare denotes local-possession requirements. Power/reset controls permit service interruption or renewed onboarding; internal modification requires enclosure access. This is a physical-design estimate, not measured incident frequency.
|
| Known vulnerabilities
|
Very common
|
[1] [2] 🔗 Proof
|
ASSESSOR INFERENCE: Very common reflects distinct published V3 weakness classes, including fragmentation DoS and historical shared-key configuration storage. It is not a prevalence measurement. Affected historical builds and corrections are separated; old V1 protocol findings are not silently attributed to V3.
|
| Prior attacks
|
None
|
[3] 🔗 Proof
|
BOUNDED PUBLIC-RECORD ASSESSMENT: None means no confirmed model-specific field botnet incident was identified in the reviewed primary sources, which describe vulnerabilities or laboratory demonstrations. It is not proof that attacks never occurred or that device risk is absent.
|
| Updatability
|
Rare
|
[4] 🔗 Proof
|
ASSESSOR INFERENCE: Rare denotes patchability with a limited publicly verifiable revision-matched history. A matching security fix and app-based update path exist; future cadence and the installed build are not established.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
[5] 🔗 Proof
|
Partial describes authenticated TP-Link ID/device use with separate local onboarding/discovery paths. It does not establish mutual authentication of every local protocol or that historical validation weaknesses persist after the named fix.
|
| Communications
|
Encrypted with up-to-date encryption
|
[6] 🔗 Proof
|
Conditional current cloud-channel scope: TP-Link documents TLS 1.2/AES-128. Use patched stock firmware and official app/cloud paths. This choice excludes optional plaintext RTSP/local integrations and older affected protocols; no individual unit was packet-tested.
|
| Storage
|
Encrypted with obselete encryption
|
[7] 🔗 Proof
|
HISTORICAL V3 SCOPE: CVE-2023-27126 identifies EU V3 firmware 1.1.22. Its configuration protection reused AES key/IV material and a weak account-password hash. The 2-point label is the closest bucket for a weak/obsolete protection implementation, not a claim that AES itself is obsolete. Claranet records a vendor correction released 26 April 2023. This historical-risk score is not a claim that patched 1.4.4 retains the flaw or a current flash audit.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Tapo supports owner/shared access with separate TP-Link IDs.
|
| Authentication
|
Basic
|
[8] 🔗 Proof
|
Conservative Basic device/recovery assessment: cloud login supports 2FA, but historical V3 research demonstrates an unauthenticated physical UART/root boundary. Strong cloud MFA is not proof of secure local recovery on every camera build; historical weakness and corrected versions are distinguished.
|
| Brute-force protection
|
Basic
|
[9] 🔗 Proof
|
Basic, cloud-account scope: TP-Link ID recovery guidance explicitly covers locked accounts. This supports limited cloud lockout, not a verified failed-attempt threshold or local device throttling. Cloud 2FA is a separate control.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
Partial logging, cloud-account scope: official 2FA guidance describes Login Activity with IP-derived location and trusted devices. These are account-login records, not a complete local administrator audit trail.
|
| Passwords
|
Require change after setup
|
[10] 🔗 Proof
|
Users create the shared TP-Link ID password rather than retain a common factory account password. Reset rules permit 6-32 characters; stronger mixed composition is recommended, not universally enforced. The nearest 2-point bucket describes this cloud/setup-password scope.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Vendor firmware; 1.4.4 Build 250922 is a patch reference, not an observed installation. (Companion App: Tapo app; TP-Link ID)
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity:
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Research assessment reviewed 2026-10-22. This grade is an assessor risk profile based on the stated evidence and inferences, not a test or certification of an individual installed device.
Assessment scope and limits
Hardware V3, stock firmware. V3-specific fix reference: 1.4.4 Build 250922. Generic family-page features may describe newer revisions. Cloud app access and optional local RTSP are separate channels.
Historical vulnerability evidence, current documented capabilities and assessor inferences are identified separately in the comments. Historical-build findings are not asserted in every patched build. Configuration-dependent benefits apply only when the specified settings are enabled. The rubric does not define numerical Rare/Very common thresholds; qualitative mappings are explained.
DATE PROXY approved for this review: 3 September 2019 is the official Tapo C200/P100 series announcement, not the verified first-sale date of the selected hardware revision or Australian variant. Official Tapo series announcement at IFA
Calculation cross-check
Device CRIS 2, 3, 1, 2, CATS 2. System CRIS 2, 1, 2, CATS 2. User Authentication CRIS 2, 2, 2, 2, 2, CATS 2. GRAS 6; expected Grade B. Methodology
Historical vulnerabilities and remediation
CVE-2026-12760: IPv4 fragmentation denial of service
- Affected scope: Vendor explicitly identifies C200 V3 and fixed build; earliest affected build unspecified.
- Preconditions: Unauthenticated adjacent-network attacker delivering malformed packets.
- Impact: Resource exhaustion and temporary loss of camera monitoring/recording.
- Remediation: V3 1.4.4 Build 250922; match region.
- Severity: CVSS 4.0: 7.1, vendor.
Revision-matching exclusion
The 2024 protocol paper tested C200 hardware 1.0.0, not V3. Its detailed protocol results are excluded from this model-specific rating. Original P100/C200 protocol research
