TP-Link Tapo C200 (V3)

TP-Link Tapo C200 (V3)
Security Grade B Calculator v	TP-Link Tapo C200 (V3) Brand: TP-Link Category: Security Camera • Model / Gen: Tapo C200 hardware V3 (not V5) Release Date: 2019-09-03 • Status: Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	ASSESSOR INFERENCE: Rare denotes local-possession requirements. Power/reset controls permit service interruption or renewed onboarding; internal modification requires enclosure access. This is a physical-design estimate, not measured incident frequency.
Known vulnerabilities	Very common	[1] [2] 🔗 Proof	ASSESSOR INFERENCE: Very common reflects distinct published V3 weakness classes, including fragmentation DoS and historical shared-key configuration storage. It is not a prevalence measurement. Affected historical builds and corrections are separated; old V1 protocol findings are not silently attributed to V3.
Prior attacks	None	[3] 🔗 Proof	BOUNDED PUBLIC-RECORD ASSESSMENT: None means no confirmed model-specific field botnet incident was identified in the reviewed primary sources, which describe vulnerabilities or laboratory demonstrations. It is not proof that attacks never occurred or that device risk is absent.
Updatability	Rare	[4] 🔗 Proof	Official US V3 notes list releases in 2025 and 2026, including 1.4.5 and 1.9.1. The limited-public-history rationale needs revision; AU rollout and the installed build are unverified. Frequency scoring requires a common observation window.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[5] 🔗 Proof	Partial describes authenticated TP-Link ID/device use with separate local onboarding/discovery paths. It does not establish mutual authentication of every local protocol or that historical validation weaknesses persist after the named fix.
Communications	Encrypted with up-to-date encryption	[6] 🔗 Proof	Conditional current cloud-channel scope: TP-Link documents TLS 1.2/AES-128. Use patched stock firmware and official app/cloud paths. This choice excludes optional plaintext RTSP/local integrations and older affected protocols; no individual unit was packet-tested.
Storage	Encrypted with obselete encryption	[7] 🔗 Proof	HISTORICAL V3 SCOPE: CVE-2023-27126 identifies EU V3 firmware 1.1.22. Its configuration protection reused AES key/IV material and a weak account-password hash. The 2-point label is the closest bucket for a weak/obsolete protection implementation, not a claim that AES itself is obsolete. Claranet records a vendor correction released 26 April 2023. This historical-risk score is not a claim that patched 1.4.4 retains the flaw or a current flash audit.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	Tapo supports owner/shared access with separate TP-Link IDs.
Authentication	Basic	[8] 🔗 Proof	Conservative Basic device/recovery assessment: cloud login supports 2FA, but historical V3 research demonstrates an unauthenticated physical UART/root boundary. Strong cloud MFA is not proof of secure local recovery on every camera build; historical weakness and corrected versions are distinguished.
Brute-force protection	Basic	[9] 🔗 Proof	TP-Link support states that frequent failures can lock a Tapo App account. This supports cloud-account protection; thresholds, duration and C200 local-interface behavior are not established.
Event logging	Partial logging	🔗 Proof	Partial logging, cloud-account scope: official 2FA guidance describes Login Activity with IP-derived location and trusted devices. These are account-login records, not a complete local administrator audit trail.
Passwords	Require change after setup	[10] 🔗 Proof	Users create the shared TP-Link ID password rather than retain a common factory account password. Reset rules permit 6-32 characters; stronger mixed composition is recommended, not universally enforced. The nearest 2-point bucket describes this cloud/setup-password scope.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Vendor firmware; 1.4.4 Build 250922 is a patch reference, not an observed installation. (Companion App: Tapo app; TP-Link ID)
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: 64 MB RAM (512 Mbit) • Storage: 8 MB ROM (64 Mbit); microSD up to 512 GB with applicable firmware, card not included
Power, Battery & Charging	Battery: • Power: Adapter AC 100–240 V, 50/60 Hz; DC 9 V, 0.6 A • Charging:
Display & Camera	Display: • Camera: 1920×1080, 15 fps, H.264; 1/2.9-inch sensor
Sound & Connectivity	Sound: Built-in microphone and speaker; two-way audio • Connectivity: 2.4 GHz 802.11b/g/n Wi-Fi; RTSP/ONVIF configurable; no Ethernet
Physical (Dimensions & Mass)	Dimensions: 86.6 × 85 × 117.7 mm (W×D×H; AU V3) • Mass: 190 g / 6.7 oz (AU V3)

Evidence review addendum — 2026-10-24. Public-document review; ratings with evidence gaps remain provisional.

This addendum supersedes earlier inconsistent wording on the same fields. It is based on public documents and the saved website snapshot; no installed device was tested. Historical research below remains historical evidence. Unverified flash protection and interface-specific controls are not verified device facts.

Documented basic information

• 尺寸: 86.6 × 85 × 117.7 mm (W×D×H; AU V3) Source
• 重量: 190 g / 6.7 oz (AU V3) Source
• 内存: 64 MB RAM (512 Mbit) Source
• 存储: 8 MB ROM (64 Mbit); microSD up to 512 GB with applicable firmware, card not included Source
• 电源: Adapter AC 100–240 V, 50/60 Hz; DC 9 V, 0.6 A Source
• 摄像头: 1920×1080, 15 fps, H.264; 1/2.9-inch sensor Source
• 声音: Built-in microphone and speaker; two-way audio Source
• 连接方式: 2.4 GHz 802.11b/g/n Wi-Fi; RTSP/ONVIF configurable; no Ethernet Source

Revised security evidence notes

• 防暴力破解: TP-Link support states that frequent failures can lock a Tapo App account. This supports cloud-account protection; thresholds, duration and C200 local-interface behavior are not established. Source Source
• 更新能力: Official US V3 notes list releases in 2025 and 2026, including 1.4.5 and 1.9.1. The limited-public-history rationale needs revision; AU rollout and the installed build are unverified. Frequency scoring requires a common observation window. Source Source

Scoring status

Existing selected scores are a saved comparison baseline, not newly validated final scores. Recheck version, region and assessment path before updating options. Recalculate CATS/GRAS and synchronize this section after all selected options are settled. Do not infer a secure or insecure flash state from a downloadable firmware image or encrypted data volumes.

---

Research assessment reviewed 2026-10-22. This grade is an assessor risk profile based on the stated evidence and inferences, not a test or certification of an individual installed device.

Assessment scope and limits

Hardware V3, stock firmware. V3-specific fix reference: 1.4.4 Build 250922. Generic family-page features may describe newer revisions. Cloud app access and optional local RTSP are separate channels.

Historical vulnerability evidence, current documented capabilities and assessor inferences are identified separately in the comments. Historical-build findings are not asserted in every patched build. Configuration-dependent benefits apply only when the specified settings are enabled. The rubric does not define numerical Rare/Very common thresholds; qualitative mappings are explained.

DATE PROXY approved for this review: 3 September 2019 is the official Tapo C200/P100 series announcement, not the verified first-sale date of the selected hardware revision or Australian variant. Official Tapo series announcement at IFA

Calculation cross-check

Device CRIS 2, 3, 1, 2, CATS 2. System CRIS 2, 1, 2, CATS 2. User Authentication CRIS 2, 2, 2, 2, 2, CATS 2. GRAS 6; expected Grade B. Methodology

Historical vulnerabilities and remediation

CVE-2026-12760: IPv4 fragmentation denial of service

• Affected scope: Vendor explicitly identifies C200 V3 and fixed build; earliest affected build unspecified.

• Preconditions: Unauthenticated adjacent-network attacker delivering malformed packets.

• Impact: Resource exhaustion and temporary loss of camera monitoring/recording.

• Remediation: V3 1.4.4 Build 250922; match region.

• Severity: CVSS 4.0: 7.1, vendor.

• Evidence: Tapo C200 V3 vulnerability

Revision-matching exclusion

The 2024 protocol paper tested C200 hardware 1.0.0, not V3. Its detailed protocol results are excluded from this model-specific rating. Original P100/C200 protocol research