TP-Link Tapo C200

TP-Link Tapo C200
Security Grade B Calculator v	TP-Link Tapo C200 Brand: TP-Link (Parent: TP-Link Systems Inc.) Category: Smart Camera • Model / Gen: V3 C200 Release Date: 2019-09-01 • Status: End of sale Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	None	🔗 Proof	No specific evidence of hardware tampering was identified in the cited source. This does not establish that the device has no physical attack surface.
Known vulnerabilities	Rare	🔗 Proof	TP-Link reported three vulnerabilities affecting Tapo C200 V3: CVE-2025-8065 (ONVIF parser buffer overflow), CVE-2025-14299 (improper Content-Length validation), and CVE-2025-14300 (unauthenticated access to the connectAP API). The affected firmware versions are below V3_1.4.5 Build 251104. Updated firmware should be used.
Prior attacks	Rare	🔗 Proof	I found no confirmed evidence in the cited source of exploitation of Tapo C200 V3. However, the absence of a listing does not prove that no attacks have occurred.
Updatability	Very common	🔗 Proof	TP-Link pushes firmware OTA via the Tapo app and issues security advisories.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	CVE-2025-14300 describes unauthenticated access to the connectAP API on affected Tapo C200 V3 firmware. This indicates an authentication weakness in the affected versions; it does not establish that all system integrations lack authentication.
Communications	Encrypted with up-to-date encryption	🔗 Proof	Control and video streams use TLS/HTTPS to Tapo cloud.
Storage	Encrypted with obselete encryption	🔗 Proof	TP-Link's official Tapo C200 V3 support page documents local microSD storage, but the reviewed documentation does not establish whether locally stored recordings are encrypted. The encryption status therefore remains unverified and should not be interpreted as confirmed obsolete encryption.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	Tapo account handles registration, password recovery and device sharing.
Authentication	Basic	🔗 Proof	Account + cloud auth exists but RCE flaws (CVE-2025-8065) bypass device auth on the LAN.
Brute-force protection	Exist	🔗 Proof	Cloud login rate limiting is present.
Event logging	Partial logging	🔗 Proof	Motion/event alerts visible in app; no full auth audit trail exposed.
Passwords	Require change after setup	🔗 Proof	Account password required at setup with single-use device code; no enforced complexity.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	TP-Link embedded Linux firmware (Companion App: Tapo app (Android/iOS))
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage: microSD card (up to 256 GB), Tapo Care cloud
Power, Battery & Charging	Battery: • Power: 5 V/1 A USB adapter • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: 2.4 GHz Wi-Fi (802.11n)
Physical (Dimensions & Mass)	Dimensions: • Mass:

Vulnerabilities & Attack Surface

• Product: TP-Link Tapo C200 V3
• Evidence source: https://www.tp-link.com/uk/support/faq/4849/

• CVE-2025-8065: A stack-based buffer overflow in the ONVIF SOAP parser may allow unauthenticated remote code execution from the local network.
• CVE-2025-14299: Improper Content-Length validation in HTTPS requests may allow denial of service.
• CVE-2025-14300: Unauthenticated access to the connectAP API may allow unauthorized Wi-Fi configuration changes and denial of service.

• Affected firmware: Versions earlier than V3_1.4.5 Build 251104, according to the vendor advisory.
• Attack surface: The documented issues affect network-facing services and may be exploitable by an attacker with access to the local network.
• Mitigation: Install the applicable vendor firmware update and verify the installed hardware version and firmware build.

• Scope limitation: These findings apply to the affected firmware versions described in the advisory. They do not establish that every Tapo C200 V3 device is currently vulnerable, nor do they establish the encryption status of locally stored microSD recordings.