TP-Link Tapo C210 CVE-2026-105814

Exploitation requires the attacker to be on the adjacent network (same LAN/Wi-Fi segment as the camera, per AV:A) and to send a single crafted request to the device's DS JSON API that simultaneously contains a protected operation AND public onboarding-related fields; this specific field combination is what causes module-level authorization checks to be applied inconsistently and bypassed. No valid authenticated session is needed (PR:N) and no user interaction is required (UI:N). Limiting factors: the camera is not exploitable from the public internet by default (adjacent-vector only), the impact is bounded to protected camera operations such as PTZ control rather than full device takeover, and it applies specifically to the Tapo C210 V3.60 firmware; patched firmware from TP-Link removes the inconsistent authorization behavior.

This is a moderate, not top-tier, priority. The CVSS 4.0 base score of 5.3 (MEDIUM) is driven by adjacent attack vector (AV:A), low complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N), but with only low confidentiality and integrity impact (VC:L/VI:L) and no availability impact - consistent with an attacker being able to issue protected camera operations like PTZ rather than fully compromising the device. The AV:A requirement is the single biggest risk limiter: the attacker must already be on the adjacent network (same Wi-Fi/LAN segment), so this is not an internet-wide remotely exploitable flaw and cannot be mass-exploited across the public internet in default home deployments. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be quantified from the available signals - treat the absence of KEV/POC as 'not reported here,' not as proof of non-exploitability. The signals are internally consistent (PR:N matches the authentication-bypass nature described, and limited impact matches the 'manipulate camera functionality' description), so there is no contradiction to flag between the CVSS vector and the description. Net: a real but low-severity, proximity-gated auth bypass that a security-conscious owner should patch, not an emergency.

An attacker who has gained a foothold on the same local or Wi-Fi network as the camera (e.g. a guest network, a compromised IoT device, or an untrusted roommate) sends a crafted JSON request to the Tapo C210's DS JSON API that bundles a protected operation together with public onboarding-related fields. Because module-level authorization is applied inconsistently to such a mixed request, the protected operation executes without any authenticated session, letting the attacker steer the camera via pan-tilt-zoom. No public exploit code was identified in the provided data, and exploitation requires adjacent-network access rather than internet reachability.