TP-Link Tapo C120 (V1)

TP-Link Tapo C120 (V1)
Security Grade B Calculator v1	TP-Link Tapo C120 Brand: TP-Link (Parent: TP-Link Systems Inc.) Category: Camera • Model / Gen: V1 Tapo C120 Release Date: 2023-05-01 • Status: In sale Classification Date: 2026-10-23 • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	https://www.tapo.com/en/product/tapo-c120-security-camera/v1/1-pack/support/ 🔗 Proof	The microSD slot and reset control are accessible; indoor/outdoor mounting increases physical exposure.
Known vulnerabilities	Very common	https://nvd.nist.gov/vuln/detail/CVE-2026-102369 🔗 Proof	NVD lists five CVE records for C120 V1, including unauthenticated local-network command execution and login-challenge replay issues.
Prior attacks	None	🔗 Proof	No model-specific IoT botnet campaign was found in the public NVD records reviewed.
Updatability	Very common	🔗 Proof	TP-Link maintains a product-specific support and firmware download page.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Works with Alexa and Google Assistant through account and cloud linking; cross-ecosystem mutual authentication is not documented.
Communications	Encrypted with up-to-date encryption	https://privacy.tp-link.com/web/official/privacy-policy?region=US 🔗 Proof	Tapo describes encrypted cloud protection for recordings and uses the Tapo app/cloud rather than an unencrypted management protocol.
Storage	Encrypted with obselete encryption	🔗 Proof	Cloud recordings are described as encrypted, but local microSD recordings are not documented as encrypted at rest.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	https://privacy.tp-link.com/web/official/privacy-policy?region=US 🔗 Proof	A Tapo account provides device sharing; granular administrator roles are not documented.
Authentication	Basic	https://privacy.tp-link.com/web/official/privacy-policy?region=US 🔗 Proof	Account password login; device-specific two-factor authentication is not documented.
Brute-force protection	Basic	https://privacy.tp-link.com/web/official/privacy-policy?region=US 🔗 Proof	A lockout or rate-limit policy is not publicly documented; partial evidence only.
Event logging	Partial logging	🔗 Proof	Motion and person events with cloud video history are available; a local administrator access log is not documented.
Passwords	Require change after setup with complexity requirements	https://www.tapo.com/en/product/tapo-c120-security-camera/v1/1-pack/support/ 🔗 Proof	No shared default device password is documented; setup is tied to a user-created Tapo account password.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Embedded Linux firmware (Companion App: Tapo app (Android/iOS))
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage: microSD card up to 512 GB; optional Tapo Care cloud storage
Power, Battery & Charging	Battery: No • Power: DC power adapter • Charging: No
Display & Camera	Display: No • Camera: 2K 4MP indoor/outdoor camera with night vision
Sound & Connectivity	Sound: Two-way audio • Connectivity: 2.4 GHz Wi-Fi
Physical (Dimensions & Mass)	Dimensions: • Mass:

The C120 is a modern consumer camera with encrypted cloud transport and updatable firmware. Its grade is driven mainly by five published CVE records for the V1 hardware. The local microSD path is not documented as encrypted, so storage is rated partial rather than fully encrypted.