| TP-Link Tapo C200
|
|
Security Grade
Calculator v
|
TP-Link Tapo C200
Release Date: 2019-09-01 • Status: End of sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
None
|
🔗 Proof
|
No exposed debug ports; physical tampering is not documented as a common attack path.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
Stack-based buffer overflow in ONVIF SOAP parser (CVE-2025-8065, CVSS 8.7) plus connectAP unauth access (CVE-2025-14300) and MacTool command injection (CVE-2026-102369).
|
| Prior attacks
|
None
|
🔗 Proof
|
No in-the-wild botnet campaign targeting Tapo C200 identified; not listed in CISA KEV.
|
| Updatability
|
Very common
|
🔗 Proof
|
TP-Link pushes firmware OTA via the Tapo app and issues security advisories.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Unauthenticated access to connectAP API (CVE-2025-14300) weakens device-to-system authentication.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Control and video streams use TLS/HTTPS to Tapo cloud.
|
| Storage
|
Encrypted with obselete encryption
|
🔗 Proof
|
Local microSD recordings are plain files with no documented at-rest encryption.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Full
|
🔗 Proof
|
Tapo account handles registration, password recovery and device sharing.
|
| Authentication
|
Basic
|
🔗 Proof
|
Account + cloud auth exists but RCE flaws (CVE-2025-8065) bypass device auth on the LAN.
|
| Brute-force protection
|
Exist
|
🔗 Proof
|
Cloud login rate limiting is present.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
Motion/event alerts visible in app; no full auth audit trail exposed.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
Account password required at setup with single-use device code; no enforced complexity.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
TP-Link embedded Linux firmware (Companion App: Tapo app (Android/iOS))
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage: microSD card (up to 256 GB), Tapo Care cloud
|
| Power, Battery & Charging
|
Battery: • Power: 5 V/1 A USB adapter • Charging:
|
| Display & Camera
|
Display: • Camera:
|
| Sound & Connectivity
|
Sound: • Connectivity: 2.4 GHz Wi-Fi (802.11n)
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Vulnerabilities & Attack Surface
- CVE ID：CVE‑2025‑14300
- Vulnerability description：Unauthenticated access to connectAP API endpoint. Attackers inside the local LAN can access sensitive API without valid login credentials.
- Attack vector：Adjacent network (LAN). No authentication required.
CIA Triad Impact Analysis
- Confidentiality: The attacker can read device configuration data, including Wi‑Fi related settings, leaking household network information.
- Integrity: The attacker can modify the Wi‑Fi configuration of camera, force the device to connect to malicious rogue access point; tamper device runtime settings.
- Availability: After modification of network configuration, camera will lose connection to original network; legitimate users cannot view camera stream, making the surveillance device unavailable.
Mitigations / Countermeasures
- 1. Upgrade camera firmware to latest official version provided by TP‑Link to patch these API vulnerabilities.
- 2. Isolate IoT camera into separate VLAN; do not place it together with work / personal computers on main LAN.
- 3. Restrict LAN access for IoT devices; disable unnecessary external API interfaces.
- 4. Avoid exposing the camera to public internet.
References
[1] https://nvd.nist.gov/vuln/detail/CVE-2025-14300
[2] TP‑Link official security advisory for Tapo C200
