Security researchers have released details of two zero-day vulnerabilities found in TP-Link security cameras commonly used in home and small offices, one of which could enable attackers to spy on users.
OPSWAT said the bugs affect the TP-Link Tapo C200 camera often used for baby/pet monitoring, home security and SOHO business security.
CVE-2026-15315 and CVE-2026-15316 were patched by the Chinese manufacturer in firmware version V5_1.4.6 released on August 18.
CVE-2026-15315 is an authentication bypass through replay which could allow an attacker with network access to the camera to obtain a valid administrative session without knowing or recovering the user’s password.
Read more on camera hacks: #BHUSA: Security Researchers Uncover Critical Flaws in Axis CCTV Software.
“The resulting administrative access enables the attacker to invoke privileged management functions, modify device configuration and perform operations that would normally require authorized administrator access,” OPSWAT explained.
“This access may also expose privacy-sensitive camera functionality, including live video streams and stored recordings, enabling unauthorized surveillance of footage captured by the affected device.”
Dahvid Schloss, COO at Suzu Labs, said the high-severity flaw is less dangerous than it sounds, because an attacker would have to be on the same network as the camera in order for it to work.
“If someone’s made it that far into your network, they’re not after the baby monitor,” he added. “Now, if the camera was port-forwarded to the internet, that’s a bigger design issue and probably should be a concern, but not a common setup for the everyday home user.”
CVE-2026-15316 is a denial-of-service vulnerability which impacts the camera’s onboarding configuration flow. Encrypted credential data needs to be validated before being passed to cryptographic and configuration-processing routines.
“An unauthenticated attacker with network access to the camera can submit an oversized encrypted credential value,” OPSWAT wrote. “When the malformed data reaches the vulnerable processing path, it can cause the camera’s HTTPS service to crash, resulting in a denial-of-service condition.”
A Third Vulnerability Could Be Worse
While both of the published vulnerabilities are high severity, OPSWAT is currently working with the camera-maker on an additional zero day it found, which it rates as critical.
“It could allow an attacker to fully compromise the camera and use the compromised device as a foothold within the network,” OPSWAT claimed.
“I would guess the exploit would be a command injection or a memory-safety bug in the same management service, chained behind that auth bypass to get code execution as root, where they then dropped a static binary to return a shell on the device whose firmware ships with almost no tooling,” said Suzu Labs’ Schloss.
“That attack chain isn’t uncommon on cheap, older consumer IoT devices where security wasn’t top of mind, but if that’s the case here, seeing it hold up on a modern TP-Link device would be a bit of a blast from the past.”
Details will be shared once a fix is available.
Image credit: tinhkhuong / Shutterstock.com
