CVE-2026-15315 is a high severity improper authentication flaw (CVSS 8.8) in TP-Link Tapo C120 v1 and C200 v5 cameras. An attacker on the local network can bypass login and obtain administrative session tokens. Fixed in C120 firmware 1.9.3 Build 260521 and C200 V5_1.4.6 Build 260709.
What's affected
- TP-Link Tapo C120 hardware version v1, fixed in firmware 1.9.3 Build 260521.
- TP-Link Tapo C200 hardware version v5, fixed in firmware V5_1.4.6 Build 260709 Rel.27675n.
- The attacker must be on the same local network.
- Mitigation: update. TP-Link lists no other workaround.
Severity: the record scores this 8.8 High (vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The TP-Link FAQ page I read did not state a score for this CVE.
How to check if you're exposed
Check each camera's firmware in the Tapo app under device settings, and read its hardware version from the label. Match them to the fixed builds above.
Cameras belong on a network segment of their own. Check which devices and users can reach them on the local network, because a local attacker is the whole premise of this flaw. Guest Wi-Fi and shared office networks deserve particular attention.
What to do now
- List Tapo C120 and C200 cameras with hardware and firmware versions.
- Update to the fixed firmware: 1.9.3 Build 260521 for C120 v1, V5_1.4.6 Build 260709 for C200 v5.
- Move cameras to a separate network or VLAN with limited access.
- Change the camera account password after updating, and review who has access in the app.
Why it matters
The record classes this as CWE-287 (Improper Authentication). TP-Link says the login verification module does not validate challenge parameters well enough. Someone on the local network can skip the normal authentication controls and get administrative session tokens, then perform privileged management actions.
For a camera, administrative access can mean seeing or controlling video and settings, plus temporary disruption of the device. The record's vector rates impact as high across confidentiality, integrity and availability. The attack needs adjacent network access, so segmentation reduces it. The record does not list the CVE as exploited, and it is not in the CISA KEV catalog.
Camera firmware updates are rarely automatic. Check whether auto update is enabled in the Tapo app, and note the date you applied this fix. If a camera is end of life or stops getting updates, plan to replace it, since local network flaws in cameras tend to repeat.
Quick check
Can this be exploited over the internet?
The vector is adjacent network, so the attacker needs to be on the local network.
Which cameras are affected?
The C120 v1 and C200 v5, per TP-Link.
Sources
Last reviewed: 18 October 2026.
