TP-Link Tapo C520WS (C520WS)
From Wiki-IoT
| TP-Link Tapo C520WS (C520WS) | ||
|---|---|---|
|
Security Grade
Calculator v1
|
TP-Link Tapo C520WS (C520WS)
Brand: TP-Link (Parent: TP-Link Systems Inc.) Category: Outdoor pan/tilt security camera • Model / Gen: C520WS Release Date: 2024-01-01 • Status: In sale Classification Date: 2026-10-27 • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | 🔗 Proof | Outdoor housing with screws; SD card slot and reset button physically accessible. |
| Known vulnerabilities | Very common | [1] 🔗 Proof | CVE-2025-8065 (CVSS 8.7): stack buffer overflow in the ONVIF SOAP parser on C520WS v2.6 gives unauthenticated RCE on the local network. |
| Prior attacks | Rare | 🔗 Proof | TP-Link cameras are a standing target in IoT botnets; the parent brand has models on the CISA KEV list (CVE-2023-1389). |
| Updatability | Very common | 🔗 Proof | Firmware 1.2.4 Build 260326 Rel.24666n published with the advisory; TP-Link runs a formal PSIRT with a 90-day disclosure window. |
| Category Score | Score: 2 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | No | 🔗 Proof | The advisory states the ONVIF RCE is exploitable by an unauthenticated attacker on the same LAN — full compromise without credentials. |
| Communications | Encrypted with obselete encryption | 🔗 Proof | HTTPS is exposed on the device, but ONVIF and RTSP paths are reachable without transport security. |
| Storage | Encrypted with obselete encryption | 🔗 Proof | microSD and NVR recordings are stored unencrypted. |
| Category Score | Score: 3 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Basic | 🔗 Proof | Tapo account supports sharing but not fine-grained roles. |
| Authentication | Absent | 🔗 Proof | Same as above: the vulnerable parser is reached pre-authentication. |
| Brute-force protection | Basic | 🔗 Proof | Basic account lockout; no device-level brute-force protection on the ONVIF interface. |
| Event logging | Access event logged | 🔗 Proof | Motion events and camera access are logged in the app. |
| Passwords | Require change after setup | 🔗 Proof | Strong password enforced at account creation, but no rotation and no unique per-device secret. |
| Category Score | Score: 2 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Linux (Tapo firmware) (Companion App: Tapo) |
| Hardware (CPU / GPU) | CPU: • GPU: |
| Memory & Storage | Memory: • Storage: |
| Power, Battery & Charging | Battery: • Power: • Charging: |
| Display & Camera | Display: • Camera: |
| Sound & Connectivity | Sound: • Connectivity: Wi-Fi 2.4 GHz, Ethernet |
| Physical (Dimensions & Mass) | Dimensions: • Mass: |
