(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
| TP-Link Tapo C260 (C260)
|
|
Security Grade
Calculator v
|
Tapo C260 Pan/Tilt AI Home Security Wi-Fi Camera
Category: IP Camera • Model / Gen: Hardware V1 C260
Release Date: 2025-06-24 • Status:
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
Inference: reset, removable storage and power are physical-access surfaces; Rare is a qualitative assessment, not measured incident frequency.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
V1: CVE-2026-0651/0652/0653 affect firmware before 1.1.9 Build 251226 Rel.55870n. Historical findings; not a claim that current patched firmware remains vulnerable.
|
| Prior attacks
|
None
|
🔗 Proof
|
No model-specific in-the-wild incident identified in the cited advisory/review as of 2026-10-25. This limited finding does not prove attacks never occurred.
|
| Updatability
|
Very common
|
🔗 Proof
|
Vendor provides model-specific firmware fixes and an upgrade path; future support is not guaranteed.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
Separate local-camera credentials support third-party RTSP/ONVIF. Uniform mutual authentication across all interfaces is not established; Partial is a conservative inference.
|
| Communications
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Rates documented cloud/HTTPS encryption (TLS 1.2/AES-128); does not assert optional RTSP traffic is encrypted.
|
| Storage
|
No encryption
|
🔗 Proof
|
Conservative inference for removable microSD recordings: C260 is not listed for SD-card encryption. Internal flash credential storage remains unverified.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Owner can share/revoke access; permission tiers are rollout-dependent. Basic conservatively reflects limited verified role coverage.
|
| Authentication
|
Basic
|
🔗 Proof
|
Cloud 2FA is available; local camera accounts use separate credentials. Basic reflects mixed interfaces, not absence of cloud 2FA.
|
| Brute-force protection
|
Basic
|
🔗 Proof
|
Inference: shared TP-Link ID has an account-lock/recovery mechanism. Model-specific local login limits were not verified; no all-interface lockout guarantee.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
Cloud login activity is documented. Full local access-audit coverage was not established.
|
| Passwords
|
Require change after setup
|
🔗 Proof
|
Interpretation: user establishes personal TP-Link/local-camera credentials during setup. Mandatory rotation after setup and full complexity enforcement were not independently verified.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
(Companion App: Tapo)
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage: microSD card up to 512 GB (card not included)
|
| Power, Battery & Charging
|
Battery: • Power: 5 V DC, 2 A • Charging:
|
| Display & Camera
|
Display: • Camera: 8 MP, 3840 x 2160
|
| Sound & Connectivity
|
Sound: • Connectivity: 2.4/5 GHz Wi-Fi (802.11a/b/g/n); Bluetooth 5.0
|
| Physical (Dimensions & Mass)
|
Dimensions: • Mass:
|
Desk-based assessment dated 2026-10-25, not a hands-on penetration test. Scores are qualitative judgments under Wiki-IoT methodology; explicit inferences and coverage limits are recorded in each criterion.
Scope: Tapo C260 hardware V1. Historical CVEs apply only to the firmware ranges stated by the vendor; use the current firmware for the exact region and hardware version. Encryption ratings distinguish cloud/HTTPS transport from removable-card recording; internal flash encryption was not independently established.
Release date 2025-06-24 means the documented US announcement/availability date, not a proven worldwide first-sale date or a separate hardware-revision launch: https://www.tp-link.com/us/press/news/21827/
Hardware specification source: https://static.tp-link.com/upload/product-overview/2025/202501/20250124/Tapo%20C260%201.0_Datasheet.pdf
Where an exact security property was not published, the selected category is a provisional inference, not a verified claim that the capability is absent. Moderator review is requested for these judgments.
Additional references:
