TP-Link Cameras 0-Day Vulnerabilities Allow Attackers to Spy on Users

TP-Link Tapo C200 cameras were found to contain two zero-day flaws—CVE-2026-15315 (an authentication-bypass in the local HTTPS management interface that can allow attacker-created administrative sessions via replayed values) and CVE-2026-15316 (an unauthenticated denial-of-service in Wi‑Fi onboarding caused by improper validation of encrypted credential size). Discovered by OPSWAT researchers and disclosed to TP-Link, both issues were fixed in firmware V5_1.4.6 (released 2026-08-18); users are advised to update firmware, restrict management interfaces to trusted networks, and segment IoT devices.