Video doorbells used to be fixtures in sci-fi media as futuristic tech, but fast-forward to 2026, almost anyone can install one in their home for not much money or effort, with a lot of the best video doorbells making for an easy home security upgrade.

But if you still find those options a bit pricey, the Blink Video Doorbell System discounted to just AU$27.99 ahead of Amazon’s Prime Big Deal Days sale next week, should certainly make for a no-brainer addition to your home.

In our Blink Video Doorbell review, we called it one of the easiest security systems to install, with two different mounting options to suit any household, and setting it up within the Blink mobile app with the included Sync Module Core (which serves as the central system hub) takes just three steps.

Our tester found that it has good image quality at 1440p resolution and 30 frames per second, stable video connection, a wide 150º horizontal field of view and battery life rated for up to two years via three AA lithium batteries.

There’s no included indoor chime, but you can pair this doorbell with a Blink Mini camera that’s sold separately (but you can also buy a bundle with two Blink Mini 2K+ cameras for AU$48) or connect via the Alexa app on your phone to an Amazon Fire Stick or Amazon Echo Show to let you see who’s at your door on your TV or smart display.

As mentioned above, lots of features are locked behind a subscription plan, including video recording, cloud video storage, video sharing, person and vehicle detection, even photo capture. The Blink Basic Plan applies to just one device for AU$4.95 per month or AU$49.95 per year, while Blink Plus lets you add an unlimited number of Blink devices for AU$15 per month or AU$150 per year. For most households, though, the former is a good starting point at a reasonable price, which is made even more enticing by the device’s whopping 72% price drop.

Want to explore your options? Amazon has also discounted more Blink video doorbell models and cameras here.

• Cybersecurity company OPSWAT found a login bypass and a crash bug in TP-Link's Tapo C200 cameras
• TP-Link has extended that to include its C120 offering too
• Anyone on the same network could get admin access, live video, and recordings without requiring the owner's credentials

Security researchers at OPSWAT have detailed two high-severity flaws in TP-Link's Tapo C200, a pan-and-tilt indoor camera listed on Amazon for $26.99 and sold as a baby monitor and pet camera.

The more serious issue is that someone on the same network can log in as the camera's administrator without the password, accessing the live feed and stored recordings.

At least one other bug, which OPSWAT rates as critical in the same disclosure but does not detail, has not been published.

A localized login that requires no authentication

The TP-Link Tapo C200, as we noted in previous coverage of the incident, isn't just another security camera that happens to be vulnerable; it is one of the most popular models on the market, clocking in at over 3,000 sales on Amazon alone.

The Tapo C120, in its current iteration, sells over 5,000 units monthly, even as the advisory notes that its V1 hardware version is currently compromised until users update the firmware on their devices.

Both SKUs have received firmware updates that patch the vulnerabilities (CVE-2026-15315 & CVE-2026-15316), which are assigned 'high' scores of 8.7 and 7.1, respectively. However, according to TP-Link, CVE-2026-15316 does not affect the C120 camera.

However, the former vulnerability is the more pressing of the two and, according to OPSWAT, is particularly problematic for users because of how the C120 and C200 cameras function.

Both run a local management interface over HTTPS and use a challenge-response login designed to prove a client knows the owner's password. Khoi Tran, a graduate fellow at OPSWAT, and his mentor, Thai Do of the company's Unit 515 team, found a second verification path in which, under certain conditions, a value the camera hands out during login can be sent back and accepted as a valid authentication response.

The result is an administrator session after a small number of requests, with no password, no existing session, and no requirements for the new 'owner'. As a result, access includes live video, stored footage, and configuration changes.

OPSWAT's researchers pointed out that a C200 used as a baby monitor would expose "live video, night vision, crying detection and two-way audio."

The second flaw, CVE-2026-15316, affects only the C200 and sits in its Wi-Fi onboarding code. Sending the camera an oversized chunk of encrypted Wi-Fi credential data can crash its HTTPS service or restart the device outright, cutting the owner off from management and monitoring until it recovers.

The attacks are somewhat limited in scope: users aiming to exploit such vulnerabilities would need to be on the same Wi-Fi network, or within a certain trusted ecosystem, to begin with.

For now, users upgrading to TP-Link's newest firmware, issued for both models, rectifies both issues, but there might already be another security patch in the works: OPSWAT also found "a critical vulnerability that could allow an attacker to fully compromise the camera," which could then serve as a foothold inside the network.

It is currently holding off on publishing any details about the vulnerability as it waits for TP-Link to issue a patch that rectifies the situation. Neither OPSWAT nor TP-Link, however, has provided a timeline for when the patch will be available to end users.