TP-Link Tapo C260 (V1)
From Wiki-IoT
| TP-Link Tapo C260 (V1) | ||
|---|---|---|
|
Security Grade
Calculator v
|
TP-Link Tapo C260 (V1)
Brand: TP-Link (Parent: TP-Link Systems Inc.) Category: Security Camera • Model / Gen: Tapo C260 V1 Release Date: 2025-01-30 • Status: In sale Classification Date: • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | None | 🔗 Proof | No model-specific hardware-tampering history was located. The camera also provides a physical privacy mode that blocks the lens with the housing. |
| Known vulnerabilities | Very common | 🔗 Proof | TP-Link explicitly identifies Tapo C260 V1 as affected by CVE-2026-0651, CVE-2026-0652 and CVE-2026-0653, including command-injection and path-traversal issues. |
| Prior attacks | None | 🔗 Proof | The advisory confirms software vulnerabilities but does not confirm a real-world attack campaign. Responsible vulnerability disclosure is not treated as evidence of prior attacks. |
| Updatability | Very common | https://www.tp-link.com/us/support/faq/4960/ 🔗 Proof | TP-Link provides multiple V1 firmware releases with feature, stability and security improvements. Firmware 1.1.9 Build 251226 or later is required to address the cited vulnerabilities. |
| Category Score | Score: 2 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Partial | https://www.tp-link.com/nl/support/faq/4191/ 🔗 Proof | Tapo account authentication and authorized hub integration are available, but full mutual authentication for every app, cloud, hub, SmartThings and voice-assistant interface is not publicly demonstrated. |
| Communications | Encrypted with up-to-date encryption | https://www.tp-link.com/my/support/faq/2742/ 🔗 Proof | Tapo documents AES-128 encryption and TLS 1.2 for sensitive information and data transmissions. The camera supports WPA/WPA2 Wi-Fi security, while users should install the latest firmware to address separately disclosed vulnerabilities. |
| Storage | Encrypted with up-to-date encryption | https://www.tapo.com/en/product/smart-camera/tapo-c260/ 🔗 Proof | TP-Link states that AES-128 and TLS 1.2 protect sensitive information, including camera footage and user identity data, during storage and transmission. The camera supports local microSD and Tapo Care cloud storage. |
| Category Score | Score: 2 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Basic | 🔗 Proof | The owner can invite other TP-Link accounts and remove shared access. Shared users have limited permissions, but comprehensive role-based account administration is not provided. |
| Authentication | Secure | 🔗 Proof | Tapo provides optional Two-Step Verification using time-sensitive verification codes delivered through a trusted device or the registered email address. |
| Brute-force protection | Basic | 🔗 Proof | Two-Step Verification reduces unauthorized account access, but exact password-attempt limits or lockout thresholds are not publicly specified; a conservative score is used. |
| Event logging | Access event logged | 🔗 Proof | The Tapo app provides Login Activity, trusted-device management and new-login notifications, allowing users to review account access events. |
| Passwords | Require change after setup | 🔗 Proof | The camera is managed through a user-created TP-Link account rather than a published universal default password. Users can change the account password and are advised to use a strong, unique password. |
| Category Score | Score: 2 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Proprietary Tapo firmware (Companion App: Tapo app (Android/iOS)) |
| Hardware (CPU / GPU) | CPU: • GPU: |
| Memory & Storage | Memory: • Storage: microSD card up to 512 GB; Tapo Care cloud storage; compatible Tapo Hub storage |
| Power, Battery & Charging | Battery: • Power: 5 V DC power adapter, USB Type-C • Charging: |
| Display & Camera | Display: • Camera: 1/2.7-inch Progressive Scan CMOS Starlight Sensor; 4K 8MP, 3840 x 2160; 4.3 mm F1.6 lens; 360° pan and 116° tilt |
| Sound & Connectivity | Sound: Built-in microphone and speaker; two-way audio with noise cancellation; sound and light alarm • Connectivity: Dual-band 2.4/5 GHz Wi-Fi 802.11 a/b/g/n; Bluetooth onboarding; Alexa; Google Assistant; Samsung SmartThings |
| Physical (Dimensions & Mass) | Dimensions: 74.7 x 88.6 x 119.4 mm • Mass: 210.6 g |
