TP-Link Tapo C320WS

TP-Link Tapo C320WS
Security Grade B Calculator v	TP-Link Tapo C320WS Outdoor Security Camera Brand: TP-Link (Parent: TP-Link Technologies Co., Ltd.) Category: Outdoor Wi-Fi security camera • Model / Gen: V2.0 Tapo C320WS (V2.0, firmware ≤ 1.5.3 Build 260304) Release Date: 2021-09-15 • Status: In sale Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof
Known vulnerabilities	Very common	🔗 Proof
Prior attacks	None	🔗 Proof
Updatability	Very common	🔗 Proof
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	No	🔗 Proof
Communications	Encrypted with up-to-date encryption	🔗 Proof
Storage	Encrypted with up-to-date encryption	🔗 Proof
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof
Authentication	Basic	🔗 Proof
Brute-force protection	Absent	🔗 Proof
Event logging	Partial logging	🔗 Proof
Passwords	Require change after setup with complexity requirements	🔗 Proof
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Proprietary firmware (Companion App: Tapo App)
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage: microSD
Power, Battery & Charging	Battery: • Power: AC adapter • Charging:
Display & Camera	Display: • Camera: outdoor surveillance
Sound & Connectivity	Sound: Two-way audio (assumed) • Connectivity: Wi-Fi (2.4 GHz)
Physical (Dimensions & Mass)	Dimensions: • Mass:

CVE-2026-105810 (CWE-121, Stack-based Buffer Overflow): The TP-Link Tapo C320WS (V2.0, firmware ≤ 1.5.3 Build 260304) contains a stack buffer overflow in the onboarding.connect (connectAp) handler. An authenticated administrative user on the adjacent network can submit a crafted, base64-encoded Wi-Fi password exceeding 1024 bytes, overflowing a fixed-size stack buffer. Because the vulnerable binary is a non-PIE ARM executable lacking stack canaries, an attacker can reliably execute arbitrary code as root via a ROP chain calling system(). A functional proof-of-concept exploit is publicly available . Patch: firmware 1.6.6 Build 260917 Rel.81089n or later . EPSS score: 0.20%; not in CISA KEV . Disclosed Oct 2026