| TP-Link Tapo C210
|
|
Security Grade
Calculator v1
|
TP-Link Tapo C210
Release Date: 2021-03-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Physically proximate root access has been demonstrated on the sibling C200 (CVE-2022-41505) via the UART/debug interface; no dedicated mass-tampering case for the C210.
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
C210 has a password-recovery authentication bypass (CVE-2023-35717, CVSS 8.8); the Tapo camera line also carries an unauthenticated RCE in the C200 (CVE-2021-4045, CVSS 9.8) and reusable AES key material (CVE-2023-27126).
|
| Prior attacks
|
Rare
|
🔗 Proof
|
No Tapo model appears in the CISA KEV catalog and no public campaign targeting C210 specifically was found.
|
| Updatability
|
Very common
|
🔗 Proof
|
Firmware is delivered over the air through the Tapo app, with downloadable firmware and a public support/FAQ knowledge base.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Bound to a TP-Link ID cloud account and paired to the app; third-party integration exists through RTSP/ONVIF with separate local credentials.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Cloud traffic uses TLS and the app enforces certificate validation; local RTSP is unencrypted but disabled unless the user enables it.
|
| Storage
|
Encrypted with obselete encryption
|
🔗 Proof
|
microSD recordings are stored unencrypted; the C200 was found reusing a single AES key/IV pair across devices (CVE-2023-27126), so on-device crypto cannot be rated current.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
🔗 Proof
|
Account creation, password reset, device sharing with per-user roles and session management are all handled by the Tapo cloud account.
|
| Authentication
|
Basic
|
🔗 Proof
|
Cloud password authentication with optional e-mail verification codes; no hardware-backed or TOTP second factor on the camera itself.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
Cloud login has rate limiting, but the device-side password-recovery flow that CVE-2023-35717 bypassed shows protection is not uniform.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
The app shows motion/alert history and device activity, but there is no user-facing authentication audit log.
|
| Passwords
|
Require change after setup with complexity requirements
|
🔗 Proof
|
TP-Link ID enforces a minimum length plus mixed character classes; the device Wi-Fi/RTSP password must be set during onboarding.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Tapo RTOS (Companion App: Tapo app (Android/iOS))
|
| Hardware (CPU / GPU)
|
CPU: Custom embedded MCU • GPU: None
|
| Memory & Storage
|
Memory: Memory • Storage: microSD card up to 512 GB, Tapo Care cloud
|
| Power, Battery & Charging
|
Battery: No built-in battery • Power: 9 V DC adapter • Charging: No battery, DC power supply
|
| Display & Camera
|
Display: None • Camera: 3MP, 2304×1296, 850nm IR night vision
|
| Sound & Connectivity
|
Sound: Built-in microphone and speaker, two-way audio • Connectivity: 2.4 GHz Wi-Fi (802.11n), RTSP/ONVIF (local)
|
| Physical (Dimensions & Mass)
|
Dimensions: 86.5 × 85 × 118 mm • Mass: 122g
|
Reasoning: The C210 is a mainstream consumer pan/tilt camera with a decent cloud security baseline (TLS, account lifecycle, OTA updates) but a young and still-growing CVE record, including an authentication bypass specific to this model and a reused AES key/IV finding on its predecessor. Local recordings are not encrypted at rest, and the device-side recovery flow has been the weakest link. Scope note: assessment covers stock firmware with cloud mode; enabling RTSP/ONVIF exposure or disabling updates would lower the rating. Release date is the v1 launch (year/month level precision).
