Small-business owners relying on TP-Link Tapo C520WS cameras should pay attention: a new advisory reveals high-severity flaws, and you can harden quickly with a 15-minute checklist.
What happened
TP-Link published a security advisory detailing several vulnerabilities in the Tapo C520WS (v2), including issues that could allow unauthenticated or unauthorised actions and could lead to a denial-of-service or camera takeover. The advisory covers CVE-2026-6239, CVE-2026-6240, CVE-2026-6241, CVE-2026-6242, and CVE-2026-34123. TP-Link describes these as high-severity flaws and urges affected users to apply firmware updates or follow mitigations described in the advisory. For reference, you can read the official advisory here: official TP-Link security advisory.
Key takeaways from the advisory include the potential for unauthenticated configuration changes and issues stemming from how certain HTTP/streaming inputs are parsed. The combination of these flaws can impact device availability or control, especially if devices sit on networks with other critical gear.
Why it matters
For a small office, cameras aren’t just about convenience — they’re part of your security posture. If a camera is compromised, an attacker could view feeds, alter settings, or use the camera as a foothold to reach other devices on the same network. Patches exist, but the window between disclosure and patch can be tight, particularly for devices deployed outside a traditional IT environment.
Practical steps you can take now (under 15 minutes)
- Update the firmware to the patched version. Open the TP-Link Tapo app, select the C520WS device, and choose Firmware Update. If you don’t see an update in the app, follow the instructions in the official advisory and ensure your device runs a newer build (for example, 1.2.6 Build 260528 or later).
- Disable cloud access if you don’t need it. In the Tapo app, turn off Cloud Access to limit exposure to the internet and reduce the attack surface.
- Limit exposure on your network. Turn off UPnP and, if possible, place cameras on a separate guest network or VLAN to keep them isolated from critical systems.
- Review remote-management settings on your router. Disable remote-management or port forwarding to the camera from the internet unless you explicitly require it.
- Strengthen credentials and monitoring. Use a strong, unique password for your TP-Link account, enable two-factor authentication if available, and check device logs for unusual access.
- Plan for a quick replacement if patching isn’t feasible. If a patch isn’t available for your setup, consider upgrading to a model that receives ongoing security updates or temporarily decommissioning the device until you can securely replace it.
Final thoughts
Smart cameras are convenient, but they live on your network. Regular updates and sensible network hygiene go a long way toward preventing exposure. If you’d like, I can walk you through a camera-by-camera hardening plan tailored to a small office setup in a follow-up post.
For the latest on this advisory, refer to the official TP-Link advisory.