(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
| TP-Link Tapo C210 (C210)
|
|
Security Grade
Calculator v
|
Tapo C210 Pan/Tilt Home Security Wi-Fi Camera
Category: IP Camera • Model / Gen: Hardware V3.6 C210
Release Date: 2021-12-16 • Status:
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Provisional qualitative rating: consumer-accessible installation/reset controls; no independent tamper-resistance test was performed. Physical access remains a risk.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
CVE-2026-105814 (authentication bypass) and CVE-2026-105815 (credential material exposure and unauthorized media sessions) concern an adjacent-network attacker. Vendor fixed release: V3.6_1.2.7 Build 260818; a complete affected lower-version range was not enumerated. Rare is a qualitative category, not a measured prevalence estimate.
|
| Prior attacks
|
None
|
🔗 Proof
|
No model-specific in-the-wild incident was established in the reviewed sources. None is a provisional evidence-status selection, not proof that attacks have never occurred; the linked advisory establishes vulnerability, not exploitation.
|
| Updatability
|
Very common
|
🔗 Proof
|
Vendor publishes fixed firmware and an update path for this revision. Very common reflects accessible firmware updating, not a quantified patch cadence or a promise of future support.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Tapo cloud identity and the local camera account are separate. Partial is inferred for mixed interfaces; authentication is not independently verified for every path.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Official Tapo guidance documents TLS 1.2 for protected cloud transport. This rating applies to that path; local streaming interfaces and all traffic are not assumed to have equivalent protection.
|
| Storage
|
No encryption
|
🔗 Proof
|
Conservative provisional choice: the model supports local recording, but encryption of internal flash was not established. No encryption here is an assessment assumption, not a verified finding that every storage path is plaintext; review is requested.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Owner and device-sharing controls support basic account management. Full fine-grained local administration was not independently established.
|
| Authentication
|
Basic
|
🔗 Proof
|
Cloud account supports two-step verification; local camera credentials are separate. Basic is a conservative overall rating, not a claim that cloud MFA is absent.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
TP-Link ID account lockout supports a basic ecosystem-level protection inference. The exact local-interface rate limit and coverage for this hardware were not verified.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
Cloud login/device notifications support limited account activity visibility. Partial logging is provisional; motion notifications are not treated as a complete access audit log.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
An independent camera account must be created for supported local integrations, avoiding reliance on a shared factory camera password. The selected setup category is inferred; forced post-setup rotation and strong complexity enforcement were not established.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
(Companion App: )
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: • Power: • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity:
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Desk-based security assessment dated 2026-10-25; no hands-on testing. Scope: C210 Hardware V3.6. Historical CVEs apply only to the stated firmware; install current firmware for the exact region and revision.
Release date scope: Japanese original-model availability; hardware V3.6 launch date is not established.
Unpublished properties are explicitly provisional inferences because this form has no Unknown choice. They must not be read as confirmed absence of protection. Cloud transport, local interfaces, removable recordings and internal flash are distinct scopes. Moderator review is requested.
References:
