Security researchers have uncovered serious vulnerabilities in two of the most popular indoor security cameras on the market: the TP-Link Tapo C200 and C120. The flaws could allow anyone on your home Wi-Fi network to access live video feeds, recorded footage, and camera settings without knowing your password. For the millions of homeowners relying on these affordable cameras for baby monitoring, pet watching, and home security, this discovery raises urgent questions about device safety.

The Vulnerabilities Explained

Cybersecurity firm OPSWAT identified two high-severity bugs in these models. The more critical issue involves a login bypass flaw that exploits how the cameras handle local authentication. When you access your camera through your home network, the device uses a challenge-response verification system designed to confirm you know the owner’s password. Researchers discovered a second verification pathway that bypasses this protection entirely. An attacker on the same Wi-Fi network can send back a response value and gain administrator access after just a few requests, with zero knowledge of your credentials.

Once inside, intruders gain full access to everything your camera captures, including live video, night vision feeds, audio from two-way microphones, and stored recordings. The C200, frequently purchased as a baby monitor or pet camera, exposes all of these features to unauthorized users. The second vulnerability affects only the C200 and involves crashing the camera’s web interface by sending oversized encrypted data during Wi-Fi setup, temporarily disabling your ability to monitor and manage the device.

How This Affects You

family home network Wi-Fi router
Photo by Compare Fibre

The Tapo C200 sells over 3,000 units monthly on Amazon at $26.99 each, making it one of the most common indoor security cameras available. The C120 moves even faster, with over 5,000 units sold monthly. These numbers suggest hundreds of thousands of homes may be running vulnerable versions right now.

The attack requires the intruder to be on your same Wi-Fi network or within your trusted connected ecosystem, which limits exposure somewhat. However, if you have guests on your network, if your Wi-Fi password is weak or shared with neighbors, or if a family member with network access becomes a threat, your camera becomes an unprotected surveillance device pointed at your most private moments.

Babies sleeping, pets moving around, and family members in various states of dress would all be visible to an unauthorized viewer. For those using these cameras in bedrooms or bathrooms, the privacy breach extends far beyond typical home security concerns. Modern home security solutions should prioritize protecting your privacy as much as monitoring your property, making these flaws particularly troubling.

baby nursery monitoring setup
Photo by Ömürden Cengiz

The good news: TP-Link released firmware updates for both the C200 and C120 that patch these vulnerabilities. If you own either camera, updating to the latest firmware version eliminates the login bypass and crash bugs. However, TP-Link has not provided a timeline for the update rollout, and not all users may have received it yet.

More concerning, OPSWAT discovered at least one additional critical vulnerability that the researchers are not yet publicly discussing. This flaw could allow complete camera compromise, potentially giving attackers a doorway into your entire home network. TP-Link is working on a patch, but no release date has been announced.

Protecting Yourself Right Now

If you own a TP-Link Tapo C200 or C120, take these steps immediately:

  • Access your camera’s settings through the TP-Link app and check for available firmware updates
  • Install any pending updates without delay
  • Ensure your home Wi-Fi password is strong and changed regularly
  • Review who has access to your network
  • Change your camera’s default password to something unique and complex

Going forward, consider that budget-friendly cameras often represent a compromise between cost and security. Some newer affordable options offer different security approaches and offline functionality that may reduce vulnerability exposure. When choosing a security camera, research the manufacturer’s track record for security updates and responsiveness to vulnerabilities.

The TP-Link incident highlights a real problem in consumer security: popular, inexpensive devices sometimes receive less attention to security hardening than premium alternatives. Alternative products with stronger privacy-first designs exist for shoppers willing to compare options. Before your next security camera purchase, ask manufacturers about their security practices, update frequency, and vulnerability disclosure process.

For current owners, firmware updates fix the immediate threat. Monitor TP-Link’s security announcements for the additional critical patch, and install it as soon as it becomes available. Your family’s privacy depends on these devices being secure by default, not just secure after you’ve discovered they’re broken.