Tapo S505 CVE-2026-102368

Requires physical access to an affected Tapo S505 (v1.6) device and the ability to read its nonvolatile storage/firmware (e.g., flash dump), from which the device-specific cryptographic material can be recovered because it is stored in plaintext. Exploitation is strictly limited by the physical-access requirement (AV:P) - it cannot be performed remotely or over the network - and the practical impact depends on whether the recovered material can be reused against related systems or communications, which the advisory describes only as a conditional, downstream risk.

This is a genuinely medium-to-low real-world priority despite being a cryptographic-material disclosure, because the single dominant limiting factor is physical access. The vendor-supplied CVSS 4.0 vector (AV:P/AC:L/AT:P/PR:N/UI:N) explicitly scores the attack vector as Physical, which is the weakest possible access requirement for an attacker and caps the base score at 5.4 (Medium). No privileges (PR:N) and no user interaction (UI:N) are needed once the attacker holds the device, but the attacker must first physically possess or open the hardware, which excludes remote/network mass exploitation entirely. EPSS is not provided in the input, so exploitation probability cannot be quantified. The CVE is not listed as CISA KEV in the provided data and no public exploit code is referenced, so exploitation status is 'no public exploit identified at time of analysis.' One internal inconsistency to verify: the vendor vector claims VC:H/VI:H/VA:H (full triad impact), yet the description (CWE-312, cleartext storage) describes a disclosure/confidentiality issue - integrity and availability impact on the device itself are not substantiated by the text and appear to reflect downstream risk to 'related protected information or communications' rather than the device, so the Integrity/Availability High ratings may be overstated; verify with TP-Link. There is no SSVC decision data in the input to incorporate.

An attacker who obtains physical possession of a Tapo S505 device (e.g., a discarded, resold, stolen, or temporarily accessed unit) opens it and reads its nonvolatile flash storage, extracting device-specific cryptographic material stored in plaintext. With AV:P and AC:L, no authentication or user interaction is required once the hardware is in hand, but exploitation cannot be performed remotely or at scale. No public proof-of-concept is referenced in the provided data.