Tapo Camera Security: Is TP-Link's Tapo Safe? China Ties, Flaws, Fixes
Updated
Tapo is the home camera line from TP-Link, the router maker. Tapo cameras are affordable and easy to set up, which is why so many people search for them — and why so many ask whether they're safe. Here's what's actually documented, without the rumors.
1. Is TP-Link a Chinese company?
TP-Link started as the Chinese company TP-Link Technologies. In 2022, a US-based company, TP-Link Systems, split off as a separate business, and it says it is "not subject to the direction of the PRC intel apparatus" (Engadget).
In October 2025, reports said the US Commerce Department was weighing a ban on TP-Link routers. That concerned routers, not cameras, and no ban had been put in place at the time of the report (same article).
2. The vulnerabilities TP-Link disclosed
TP-Link published a security advisory for several Tapo camera models along with fixed firmware (TP-Link advisory):
- Models: Tapo C200 v3, C100 v5, C425, C520WS
- What could happen: an attacker on the same local network could crash the camera or change its Wi-Fi settings without logging in. One flaw could potentially let an attacker run code on the camera.
- Status: patched firmware is available for each model.
Because the attacker has to be on your home network, these weren't "anyone on the internet" flaws. But if you never update, the holes stay open.
3. Where does the video go?
In Korea, TP-Link said in August 2026 that it moved the relay servers for Tapo video and audio from an overseas region to AWS Seoul, and moved its paid cloud storage (Tapo Care) to domestic cloud infrastructure. Local microSD recording stays the same (Dailysecu, Korean).
Like any cloud camera, though, if you turn on cloud recording, your footage sits on the company's cloud.
If you use a Tapo camera, check these now
- Update the firmware in the Tapo app, and turn on automatic updates.
- Do you really need cloud recording? If not, turn it off and record to microSD only.
- Lock down your Wi-Fi. These flaws required access to your network, so a strong router password matters. A separate guest network for smart devices is even better.
- Clean up shared access. Remove old family or friend accounts you once shared with.
For the full checklist, see can a baby monitor be hacked?. For real-world cases, see camera leaks at Wyze, eufy, Ring and more.
Or skip buying a camera altogether
Momseye turns the old phone in your drawer into a baby monitor:
- Video is never stored on our servers
- The stream is encrypted
- Event recordings (PRO) are saved on the camera phone itself, not in a cloud
Learn more in Momseye, a free baby monitor app, or set it up with our phone-to-phone guide.