TP-Link Tapo camera flaw lets hackers seize full control – update urged

Owners of TP-Link security cameras are being urged to install updates immediately after researchers demonstrated how hackers could take complete control of the devices, install malware and attack other systems on their home networks.

OPSWAT has revealed how a new command-injection flaw can be chained with an earlier authentication bypass to fully compromise Tapo C200 V5 and C120 V1 cameras.

The attack could give hackers far greater control than previously understood, allowing them to move beyond spying through camera feeds to running malicious software directly on the devices.

Hidden tool exploited

In its latest research Khoi Tran and Thai Do, from OPSWAT’s elite bug hunting division Unit 515, explained that the new vulnerability, tracked as CVE-2026-102369 and rated severe, lies in a diagnostic service used for camera maintenance and manufacturing.

The flaw allows attackers to trick the service into treating specially crafted file-transfer instructions as commands to the camera's operating system.

Researchers discovered that the service incorporates user-supplied information into commands without adequately checking it, meaning malicious instructions can be executed instead.

“While these functions are intended for legitimate device maintenance, improper handling of external input within this privileged service introduces a significant security risk,” the researchers noted.

From password bypass to full control

Attackers could reach this vulnerable service by first exploiting the authentication bypass disclosed in August and reported by Cybernews in September.

That initial flaw allows someone on the same local network to gain administrator access without knowing the camera owner's password.

An attacker could then turn on the camera's hidden diagnostic tool, restart it, and use the new flaw to run commands on its system.

An attacker on the same local network could bypass authentication, enable the hidden diagnostic tool, restart it, and then inject commands to take over the camera.

OPSWAT researchers carried out a lab test of the exploit, showing how the two flaws could be chained together to fully compromise the device.

Attackers could gain full control of the device, deploy malware, establish persistent access, and potentially weaponize the compromised camera to launch attacks against other systems it can reach over the network,

warn OPSWAT researchers from elite bug hunting division, Unit 515

They added that a compromised camera could be used to scan for vulnerable devices or target other services within the same network, extending the threat beyond the camera itself.

Three more weaknesses

The research also uncovered three additional vulnerabilities that could allow attackers to disconnect cameras from Wi-Fi networks, obtain information about nearby wireless networks or crash the camera's HTTPS service.

• WiFi configuration: A high-severity flaw lets attackers change the camera's Wi-Fi settings without logging in, potentially knocking it off the home network and disrupting surveillance. (CVE-2026-78578)

• Information disclosure: Attackers can see details of nearby WiFi networks – including names, device IDs and security settings – without needing to log in. (CVE-2026-78577)

• Service disruption: A high-severity flaw lets unauthenticated attackers crash the camera's HTTPS service, disrupting web-based functions. (CVE-2026-9032)

TP-Link has released firmware updates fixing all six flaws, and OPSWAT is urging users to update their cameras and follow the company's security guidance.

The flaws can only be exploited by someone already on the same network as the camera, and there's no evidence yet that they've been used against real owners.