Replaying camera traffic on the LAN gets admin on TP-Link's Tapo C200

CVE-2026-15315 needs an attacker on the camera's own network, and that precondition is where the two published bugs get argued about. Dahvid Schloss, COO at Suzu Labs, said the flaw is less dangerous than it sounds because an attacker would have to be on the same network as the camera ^[7]. "If someone's made it that far into your network, they're not after the baby monitor," he said ^[8]. He named one exception: "Now, if the camera was port-forwarded to the internet, that's a bigger design issue and probably should be a concern, but not a common setup for the everyday home user." ^[9]

OPSWAT's account of the same bug is about what the session opens. The administrative access "enables the attacker to invoke privileged management functions, modify device configuration and perform operations that would normally require authorized administrator access," OPSWAT wrote ^[5]. The same advisory said that access "may also expose privacy-sensitive camera functionality, including live video streams and stored recordings, enabling unauthorized surveillance of footage captured by the affected device" ^[6].

The second bug is thinner. CVE-2026-15316 sits in the onboarding configuration flow, where encrypted credential data needs to be validated before it is passed to cryptographic and configuration-processing routines ^[10]. "An unauthenticated attacker with network access to the camera can submit an oversized encrypted credential value," OPSWAT wrote ^[11], and when that malformed data reaches the vulnerable processing path it can crash the camera's HTTPS service ^[12]. Both published bugs are rated high severity ^[13].

The one still open is the one OPSWAT rates critical. It "could allow an attacker to fully compromise the camera and use the compromised device as a foothold within the network," the company said ^[15], and it is working with TP-Link on that bug now ^[14]. Schloss guessed at how it works: "a command injection or a memory-safety bug in the same management service, chained behind that auth bypass to get code execution as root" ^[16]. That is a guess from outside the research, not OPSWAT's description. OPSWAT said details will be shared once a fix is available ^[17].

Three flaws in one camera's management surface, then: two closed in V5_1.4.6 on August 18, one open ^[18]. The reporting on the disclosure does not mention exploitation in the wild ^[19]. Anyone running C200s across branch sites has the interval between now and that third advisory to get the August firmware onto the fleet.