TP-LINK TAPO C200: HARDCODED KEYS, BUFFER OVERFLOWS AND PRIVACY IN THE ERA OF AI ASSISTED REVERSE ENGINEERING

Summary from the TLDR InfoSec newsletter

A security researcher documented AI-assisted firmware analysis of TP-Link Tapo C200 cameras using tools including Grok, GhidraMCP, and Claude Sonnet 4. They discovered hardcoded SSL private keys that enabled HTTPS traffic decryption, pre-authentication memory overflows, integer overflow crashes, and unauthenticated WiFi hijacking, affecting approximately 25,000 internet-exposed devices. The vulnerabilities enabled remote attackers to decrypt camera traffic, crash devices, force connections to malicious networks, and enumerate nearby WiFi BSSIDs for precise geolocation via Apple's location services API. TP-Link delayed patching beyond its 90-day commitment despite being a CVE Numbering Authority, raising concerns about vendor conflicts of interest when controlling their own vulnerability disclosure pipeline while marketing low CVE counts as a competitive advantage.