| TP-Link Tapo C200 | ||
|---|---|---|
|
Security Grade
Calculator v
|
TP-Link Tapo C200
Brand: TP-Link (Parent: TP-Link Systems Inc.) Category: Smart Camera • Model / Gen: C200 Release Date: 2019-09-01 • Status: End of sale Classification Date: • Official Website | |
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | None | 🔗 Proof | No exposed debug ports; physical tampering is not documented as a common attack path. |
| Known vulnerabilities | Rare | 🔗 Proof | Stack-based buffer overflow in ONVIF SOAP parser (CVE-2025-8065, CVSS 8.7) plus connectAP unauth access (CVE-2025-14300) and MacTool command injection (CVE-2026-102369). |
| Prior attacks | None | 🔗 Proof | No in-the-wild botnet campaign targeting Tapo C200 identified; not listed in CISA KEV. |
| Updatability | Very common | 🔗 Proof | TP-Link pushes firmware OTA via the Tapo app and issues security advisories. |
| Category Score | Score: 2 / 3 | ||
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Partial | 🔗 Proof | Unauthenticated access to connectAP API (CVE-2025-14300) weakens device-to-system authentication. |
| Communications | Encrypted with up-to-date encryption | 🔗 Proof | Control and video streams use TLS/HTTPS to Tapo cloud. |
| Storage | Encrypted with obselete encryption | 🔗 Proof | Local microSD recordings are plain files with no documented at-rest encryption. |
| Category Score | Score: 2 / 3 | ||
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Full | 🔗 Proof | Tapo account handles registration, password recovery and device sharing. |
| Authentication | Basic | 🔗 Proof | Account + cloud auth exists but RCE flaws (CVE-2025-8065) bypass device auth on the LAN. |
| Brute-force protection | Exist | 🔗 Proof | Cloud login rate limiting is present. |
| Event logging | Partial logging | 🔗 Proof | Motion/event alerts visible in app; no full auth audit trail exposed. |
| Passwords | Require change after setup | 🔗 Proof | Account password required at setup with single-use device code; no enforced complexity. |
| Category Score | Score: 2 / 3 | ||
| Property | Details |
|---|---|
| Operating System & App | TP-Link embedded Linux firmware (Companion App: Tapo app (Android/iOS)) |
| Hardware (CPU / GPU) | CPU: • GPU: |
| Memory & Storage | Memory: • Storage: microSD card (up to 256 GB), Tapo Care cloud |
| Power, Battery & Charging | Battery: • Power: 5 V/1 A USB adapter • Charging: |
| Display & Camera | Display: • Camera: |
| Sound & Connectivity | Sound: • Connectivity: 2.4 GHz Wi-Fi (802.11n) |
| Physical (Dimensions & Mass) | Dimensions: • Mass: |
Tapo C200 is a widely deployed indoor camera with a broad ONVIF/Wi-Fi attack surface (multiple 2025/2026 CVEs) but active vendor patching. Account management is mature and updates are frequent, yet local recordings are unencrypted and LAN-side RCE flaws undermine device authentication.
