TP-Link Tapo C200 (V3)

From Wiki-IoT
Revision as of 15:53, 21 October 2026 by Huixin Lin (talk | contribs) (Created page with "'''Evidence review: 2026-10-21. Overall IDRS grade: not assigned.''' All 12 criteria are investigated below. A documented capability, a historical vulnerability and an observ...")
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Evidence review: 2026-10-21. Overall IDRS grade: not assigned.

All 12 criteria are investigated below. A documented capability, a historical vulnerability and an observed current configuration are different evidence types. Unresolved values are explicitly not scored; absence of a public report is not evidence of absence.

This page uses an evidence table because the current Classification calculator accepts only three scored choices and cannot represent unknown values safely. It does not change the shared template or assign an unsupported grade.

Product information

Field Verified value / stated scope
Name TP-Link Tapo C200
Brand TP-Link
Model Tapo C200 hardware V3 (not V5)
Operating System Vendor firmware; 1.4.4 Build 250922 is a patch reference, not an observed installation.
Companion App Tapo app; TP-Link ID
Type Security Camera
Website https://www.tp-link.com/us/support/download/tapo-c200/v3/

Assessment scope

Hardware V3, stock firmware. V3-specific fix reference: 1.4.4 Build 250922. Generic family-page features may describe newer revisions. Cloud app access and optional local RTSP are separate channels.

No physical device, installed firmware, password, network trace or storage image was inspected. Conditional capability assessments apply only when the named settings are enabled.

Security evaluation

Device

Criterion Finding / rubric choice Evidence and reasoning
Known hardware tampering Not rated: insufficient evidence Physical features are documented; a model-specific tampering-frequency assessment was not established. Exposed physical features alone are not a measured tampering rate. C200 generic product specifications
Known vulnerabilities Confirmed vulnerabilities; frequency not quantified The records below establish historical vulnerabilities within the stated firmware scope. They do not measure prevalence or establish a Rare/Very common frequency rating. Tapo C200 V3 vulnerability
Prior attacks Not rated: insufficient evidence Model-specific field-attack frequency was not established. Research demonstrations are not incident counts. Tapo C200 V3 vulnerability
Updatability Not rated: insufficient evidence V3 patch exists; a single notice does not establish ongoing update frequency. Tapo C200 V3 vulnerability C200 US V3 downloads

System

Criterion Finding / rubric choice Evidence and reasoning
Authentication with other systems Not rated: insufficient evidence Cloud ID and separate RTSP credentials exist; complete V3 channel authentication unverified. Tapo app 2FA Tapo RTSP/ONVIF
Communications Not rated: insufficient evidence Family page advertises AES/TLS; V3 protocol versions and optional RTSP confidentiality require verification. C200 generic product specifications Tapo RTSP/ONVIF
Storage V3 flash encryption not established The vendor microSD encryption feature announcement names C460/C660, not C200 V3. It cannot support a C200 V3 encryption score. Removable recording-media encryption and firmware/configuration flash encryption are separate questions. Tapo microSD encryption supported models Tapo microSD encryption

User authentication

Criterion Finding / rubric choice Evidence and reasoning
Account management Basic (CRIS 2; scoped assessment) Tapo supports owner/shared access with separate TP-Link IDs. Tapo device sharing guidance
Authentication Secure (CRIS 1; scoped assessment) For cloud login, assumes enabled Tapo 2FA; local credentials need separate review. Tapo app 2FA Tapo RTSP/ONVIF
Brute-force protection Cloud lockout mentioned; local protection unverified TP-Link ID guidance includes account-locked recovery. No reliable model/build-specific camera or plug failed-login threshold was established. Cloud 2FA is a separate control and does not prove a local guessing limit. TP-Link ID password reset policy Tapo app 2FA
Event logging Not rated: insufficient evidence Motion/video events are not proof of administrator-access auditing. C200 generic product specifications
Passwords User-selected TP-Link ID password; device policy unverified The shared TP-Link ID has a user-selected password; current reset guidance specifies 6 to 32 characters without spaces and recommends stronger composition. Recommendations must not be described as enforced complexity. Local device credentials/onboarding require separate assessment. TP-Link ID password reset policy Shared TP-Link ID account

Rating calculation

No definitive category score or GRAS is calculated while one or more required CRIS values are unresolved. The method requires taking the ceiling of each complete category mean and summing the three category scores. An unknown must not be substituted with 1 or treated as None. Wiki-IoT methodology

Historical vulnerabilities and remediation

CVE-2026-12760: IPv4 fragmentation denial of service

  • Affected scope: Vendor explicitly identifies C200 V3 and fixed build; earliest affected build unspecified.
  • Preconditions: Unauthenticated adjacent-network attacker delivering malformed packets.
  • Impact: Resource exhaustion and temporary loss of camera monitoring/recording.
  • Remediation: V3 1.4.4 Build 250922; match region.
  • Severity: CVSS 4.0: 7.1, vendor.

Revision-matching exclusion

The 2024 protocol paper tested C200 hardware 1.0.0, not V3. Its detailed protocol results are excluded from this model-specific rating. Original P100/C200 protocol research

Product evidence notes

Retrieved from "http://fehmijaafar.net/wiki-iot/index.php?title=TP-Link_Tapo_C200_(V3)&oldid=8653"