TP-Link Tapo CVE-2026-34126

Exploitation requires the attacker to be within Bluetooth radio range (typically ~10-30 meters, line-of-sight dependent) of the target device at the exact moment the victim performs initial setup or factory-reset re-provisioning - Bluetooth is used only during initialization, so the window is short and tied to user-triggered pairing. The victim must actively initiate setup via the Tapo mobile app (UI:A), and the attack requirement AT:P indicates the attacker must be present and listening during that window. No authentication is needed on the attacker side (PR:N), and the affected devices are specifically Tapo L535E v1.0/v3.0, P300 v1.0, and D100C v1.0 running pre-patch firmware; devices already updated to the fixed firmware versions, or devices long-since provisioned and not being re-paired, are not exposed to this vector.

The CVSS 4.0 vector (AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:L) yields 7.3 and accurately reflects the threat model: adjacent (Bluetooth-range) attack vector, low complexity, no authentication required, but passive user interaction (the victim must initiate setup) and an attack requirement (AT:P - being present during the brief initialization window) are real limiters. Confidentiality and integrity impacts are High, availability Low, and there is no scope/subsequent-system impact. No EPSS score, KEV listing, or POC was provided, so this is no public exploit identified at time of analysis. Real-world risk is moderate rather than critical: the attacker must be physically within BLE range (~10-30m) at the exact moment of setup, which constrains opportunistic exploitation but is entirely feasible for targeted attacks against high-value targets (e.g., the L535E smart lock guarding a residence) or in multi-tenant environments. The smart-lock use case is the standout concern because hijacking provisioning could yield persistent access to a physical-security device.

An attacker positions a BLE sniffer (e.g., Ubertooth, nRF52840 dongle) within ~10-30 meters of a residence and waits for the victim to install a new Tapo L535E smart lock. When the victim opens the Tapo app and initiates pairing, the attacker captures the cleartext BLE provisioning frames containing Wi-Fi credentials and device-binding data, then replays or actively MITMs the setup to bind the lock to attacker-controlled cloud credentials, granting persistent unauthorized control.