rooting a Tapo C500

Sun, 07 Jun 2026 15:56:58 +0300

I bought a Tapo C500 — a cheap little pan-tilt Wi-Fi camera — fully intending to use it as a camera for about a week before the itch kicked in. You know the one: I wonder what’s running in there. Spoiler: a tiny Linux box that really didn’t want me poking around. So I poked around.

By the end I had a permanent UART console, a known root password, and persistent SSH over key auth — surviving reboots, no serial cable required. Here’s the whole ride, gotchas and all.

Ghidra on deadc0de

rooting a Tapo C500