TP-Link Tapo D230S1 (V1.20)
From Wiki-IoT
| TP-Link Tapo D230S1 (V1.20) | ||
|---|---|---|
|
Security Grade
Calculator v1
|
TP-Link Tapo D230S1
Brand: TP-Link (Parent: TP-Link Systems Inc.) Category: Doorbell • Model / Gen: V1.20 Tapo D230S1 Release Date: 2023-09-01 • Status: In sale Classification Date: 2026-10-27 • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Very common | 🔗 Proof | Outdoor doorbell with removable battery, mounting hardware, reset control, and an exposed installation surface. |
| Known vulnerabilities | Rare | 🔗 Proof | NVD documents CVE-2025-10991: UART access can yield root, but physical access is required and the issue is fixed in firmware 1.2.2. |
| Prior attacks | None | 🔗 Proof | No public model-specific botnet campaign was found; score reflects available evidence only. |
| Updatability | Very common | 🔗 Proof | TP-Link provides a version-specific support/download page. |
| Category Score | Score: 2 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Partial | 🔗 Proof | Alexa and Google Assistant integration is available; no cross-ecosystem mutual authentication is documented. |
| Communications | Encrypted with up-to-date encryption | https://privacy.tp-link.com/web/official/privacy-policy?region=US 🔗 Proof | Tapo cloud/video traffic is presented as encrypted; the doorbell uses the Tapo app and hub. |
| Storage | Encrypted with obselete encryption | 🔗 Proof | The hub supports a local microSD card and Tapo Care cloud storage; local recordings are not documented as encrypted. |
| Category Score | Score: 2 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Basic | https://privacy.tp-link.com/web/official/privacy-policy?region=US 🔗 Proof | Tapo account and shared access; detailed role separation is not documented. |
| Authentication | Basic | https://privacy.tp-link.com/web/official/privacy-policy?region=US 🔗 Proof | Account password login; device-specific 2FA is not documented. |
| Brute-force protection | Basic | https://privacy.tp-link.com/web/official/privacy-policy?region=US 🔗 Proof | No public lockout/rate-limit policy; partial evidence only. |
| Event logging | Partial logging | 🔗 Proof | Detection events and cloud/local video history exist; administrator access logs are not documented. |
| Passwords | Require change after setup with complexity requirements | https://www.tapo.com/en/product/tapo-d230s1-smart-doorbell/v1.20/1-pack/support/ 🔗 Proof | Setup uses a user-created Tapo account; no shared default device password is documented. |
| Category Score | Score: 2 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Embedded firmware (Companion App: Tapo app (Android/iOS)) |
| Hardware (CPU / GPU) | CPU: • GPU: |
| Memory & Storage | Memory: • Storage: |
| Power, Battery & Charging | Battery: Rechargeable battery • Power: • Charging: USB-C |
| Display & Camera | Display: No • Camera: |
| Sound & Connectivity | Sound: • Connectivity: 2.4 GHz Wi-Fi |
| Physical (Dimensions & Mass) | Dimensions: • Mass: |
Prepared from public product documentation, vendor security information, and NVD records. The release date is approximate where the vendor did not state a day. No device was physically tested, scanned, or attacked. Each score links to the public evidence used for the assessment.
