Tapo C325WB V2 CVE-2026-105672

Exploitation requires the attacker to be on the adjacent network (same L2/Wi-Fi segment or logically-adjacent network per AV:A) as the camera and able to reach its HTTPS JSON API dispatcher on TCP port 443. The specific trigger is appending an onboarding-scoped object to a JSON request, which causes the dispatcher to bypass session verification - this appears to work against the device's normal/default API behavior and requires no authentication (PR:N), no user interaction (UI:N), and no special victim configuration. The primary limiting factor is the adjacent-network requirement: the attacker cannot reach the device directly from the public internet and must first obtain a foothold on the local network; exploitation is otherwise low-complexity. Only Tapo C325WB V2 is listed as affected.

Multiple signals converge on a genuine high-priority issue rather than a merely high-CVSS paper risk. The vendor-supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 8.7) indicates low-complexity, unauthenticated exploitation with high confidentiality, integrity, and availability impact - fully consistent with the description of an onboarding-scoped object bypassing session verification on the port 443 JSON API. CWE-287 (Improper Authentication) matches the described authorization bypass. The one tempering factor is the attack vector: this is AV:A (adjacent network), not AV:N, so the attacker must already be on the same L2/Wi-Fi segment as the camera - a meaningful barrier compared with an internet-wide flaw, though trivial on a shared or compromised home/office Wi-Fi network. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or widespread weaponization at this time; the risk rating rests on the intrinsic ease of the bypass and the sensitivity of the asset (a live camera with audio) rather than on observed exploitation. Net: a real priority for environments where untrusted devices may share the camera's network segment, but the adjacent-only vector and absence of KEV/POC/EPSS data argue against treating it as an internet-exposed emergency.

An attacker who has gained access to the same local/Wi-Fi network as a Tapo C325WB V2 camera sends a crafted HTTPS JSON request to TCP port 443, appending an onboarding-scoped object that causes the dispatcher to skip session verification. Because exploitation is unauthenticated and low-complexity, the attacker can then stream live video and audio, alter device settings, and extract sensitive device information or secrets without ever logging in. No public exploit code was identified at time of analysis.