TP-Link Tapo · Outdoor camera · Mains power
Tapo C520WS
No subscription needed. Local storage: Yes (microSD). RTSP: Yes, off out of the box. Home Assistant: Local, official.
Last checked 1 Nov 2026 · 0 open points · 7 sources
1Where video goes
- Local storage
- Yes microSD
The maker states it for the brand or product line, not for this model by name.
- Tapo Camera ONVIF and RTSP Common Questions Answered (updated 2026-09-29) TP-Link · accessed 1 Nov 2026
- Maker's cloud
- Optional
The maker states it for the brand or product line, not for this model by name.
- Tapo Care TP-Link Tapo UK store · accessed 1 Nov 2026
2What the subscription locks
- Plan for recordings
- No subscription needed
The maker states it for the brand or product line, not for this model by name.
- Tapo Care TP-Link Tapo UK store · accessed 1 Nov 2026
- Tapo Camera ONVIF and RTSP Common Questions Answered (updated 2026-09-29) TP-Link · accessed 1 Nov 2026
| Feature | Without a plan | Source |
|---|---|---|
| Watch recordings | WorksRecordings stay on the microSD card. | The maker states it for the brand or product line, not for this model by name. Recordings stay on the microSD card.
|
| Cloud backup | Plan only | The maker states it for the brand or product line, not for this model by name.
|
| Recording to an NVR or Frigate | LimitedOnly two of Tapo Care, SD recording and NVR/RTSP recording run at once. | The maker states it for the brand or product line, not for this model by name. Only two of Tapo Care, SD recording and NVR/RTSP recording run at once.
|
| Plan | Month | Year | Cameras | Source |
|---|---|---|---|---|
| Tapo Care Premium | £2.99 | £29.49 | 1 | The maker states it for the brand or product line, not for this model by name. Starting price as listed by Tapo ("from").
|
Tapo Care is optional. Tapo says Tapo Care, SD-card recording and NVR/RTSP recording cannot all run at once: only two of the three.
3RTSP, ONVIF, Home Assistant, Frigate
- RTSP
- Yes
The maker states it for the brand or product line, not for this model by name.
- Tapo Camera ONVIF and RTSP Common Questions Answered (updated 2026-09-29) TP-Link · accessed 1 Nov 2026
- TP-Link Smart Home integration Home Assistant · accessed 1 Nov 2026
- Out of the box
- Off, must be switched on
- To switch it on
- Maker's app needed
- How to switch it on
- Tapo app: Device Settings > Advanced Settings > Camera Account. Stream: rtsp://<ip>:554/stream1.
- ONVIF
- Yes
The maker states it for the brand or product line, not for this model by name.
Profile S, port 2020, no two-way audio.
- Tapo Camera ONVIF and RTSP Common Questions Answered (updated 2026-09-29) TP-Link · accessed 1 Nov 2026
- Home Assistant
- Local, officialTP-Link Smart Home on the tested list
An official source states it for this exact model.
- TP-Link Smart Home integration Home Assistant · accessed 1 Nov 2026
- Home Assistant login
- Maker's cloud account
- Frigate
- Yes, via RTSPderived from RTSP, not tested per model
4Privacy and security timeline
Events for the TP-Link Tapo brand. Highlighted entries name this model.
- 18 Dec 2025 Research Firmware analysis of the C200: one hard-coded HTTPS private key shared by all devices (local man-in-the-middle possible) and an unauthenticated ONVIF SOAP remote code execution.
From user reports (forum, issue tracker), not confirmed by the maker.
- TP-Link Tapo C200: hardcoded keys, buffer overflows and privacy evilsocket · accessed 1 Nov 2026
- 25 Jul 2025 Research Researcher publishes how to get root on the Tapo C200 (hardware revision 5).
From user reports (forum, issue tracker), not confirmed by the maker.
- Rooting the Tapo C200 Quentin Kaiser · accessed 1 Nov 2026
- 2025 Vulnerability This model: TP-Link advisory: CVE-2025-8065 (C200, C520WS), CVE-2025-14299 and CVE-2025-14300 (C100, C425, C200). C200 v3 needs firmware 1.4.5 Build 251104 or later.
An official source states it for this exact model.
- TP-Link security advisories (Tapo cameras) TP-Link · accessed 1 Nov 2026
- 2025 Research Traffic analysis (IoTFuzzSentry) finds that the HTTP digest authentication of Tapo cameras can be forged; the authors did not build a full exploit.
From a press report, not confirmed by the maker.
- IoTFuzzSentry (arXiv 2509.09158) arXiv · accessed 1 Nov 2026
Our own tests (unplug the network, log outbound connections) are not done yet.
5Merchant SKUs per market
| Market | Merchant | ASIN | GTIN | Cameras |
|---|---|---|---|---|
| Germany | Amazon | B0CCW8GHT8 | not recorded yet | 1 |
| UK | Amazon | B0CCW8GHT8 | not recorded yet | 1 |