Zero-Day Vulnerabilities Discovered in TP-Link Cameras
Security researchers have revealed two zero-day vulnerabilities found in TP-Link security cameras, particularly the Tapo C200 model, which is commonly used for home and small office security. These vulnerabilities could allow attackers to spy on users, raising significant privacy concerns. The vulnerabilities, identified as CVE-2026-15315 and CVE-2026-15316, were addressed in a firmware update released by TP-Link on August 18.
CVE-2026-15315 is an authentication bypass vulnerability that could enable an attacker with network access to gain a valid administrative session without needing the user's password. This unauthorized access allows the attacker to perform privileged management functions, modify device settings, and potentially access sensitive camera features, including live video feeds and recorded footage.
Dahvid Schloss, COO at Suzu Labs, commented on the severity of the flaw, noting that while it is serious, an attacker would need to be on the same network as the camera for it to be exploited. He emphasized that if an attacker has already infiltrated a network, they are likely targeting more than just a baby monitor. However, if the camera is exposed to the internet through port forwarding, it could present a more significant risk.
New Denial-of-Service Vulnerability Identified
The second vulnerability, CVE-2026-15316, is a denial-of-service issue affecting the camera's onboarding configuration. An unauthenticated attacker could submit oversized encrypted credential data, causing the camera's HTTPS service to crash and resulting in a denial-of-service condition.
Cleared for Release
Both vulnerabilities are classified as high severity, but OPSWAT is also investigating another critical zero-day vulnerability that could allow an attacker to fully compromise the camera and use it as a foothold within the network. Schloss speculated that this exploit might involve command injection or a memory-safety bug, which is not uncommon in older consumer IoT devices that lack robust security measures.
As OPSWAT continues to work with TP-Link to address these vulnerabilities, further details will be shared once a fix is available.
