| TP-Link Tapo C320WS
|
|
Security Grade
Calculator v1
|
TP-Link Tapo C320WS Outdoor Security Camera
Release Date: 2021-09-15 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
|
| Prior attacks
|
None
|
🔗 Proof
|
|
| Updatability
|
Very common
|
🔗 Proof
|
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
No
|
🔗 Proof
|
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
|
| Storage
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
|
| Authentication
|
Basic
|
🔗 Proof
|
|
| Brute-force protection
|
Absent
|
🔗 Proof
|
|
| Event logging
|
Partial logging
|
🔗 Proof
|
|
| Passwords
|
Require change after setup with complexity requirements
|
🔗 Proof
|
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Proprietary firmware (Companion App: Tapo App)
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage: microSD
|
| Power, Battery & Charging
|
Battery: • Power: AC adapter • Charging:
|
| Display & Camera
|
Display: • Camera: outdoor surveillance
|
| Sound & Connectivity
|
Sound: Two-way audio (assumed) • Connectivity: Wi-Fi (2.4 GHz)
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
CVE-2026-105810 (CWE-121, Stack-based Buffer Overflow): The TP-Link Tapo C320WS (V2.0, firmware ≤ 1.5.3 Build 260304) contains a stack buffer overflow in the onboarding.connect (connectAp) handler. An authenticated administrative user on the adjacent network can submit a crafted, base64-encoded Wi-Fi password exceeding 1024 bytes, overflowing a fixed-size stack buffer. Because the vulnerable binary is a non-PIE ARM executable lacking stack canaries, an attacker can reliably execute arbitrary code as root via a ROP chain calling system(). A functional proof-of-concept exploit is publicly available . Patch: firmware 1.6.6 Build 260917 Rel.81089n or later . EPSS score: 0.20%; not in CISA KEV . Disclosed Oct 2026
