TP-Link Tapo C210 EUVD-2026-104644

Exploitation requires the attacker to be on the same adjacent network as the camera (AV:A) - typically the local LAN or Wi-Fi segment the Tapo C210 is connected to; it is NOT exploitable directly from the internet without first obtaining such adjacent access. The specific trigger is sending unauthenticated DS JSON API requests to the device, which expose shared credential material and cryptographic metadata; the exposed shared credential is then accepted by the Streamd Digest authentication mechanism as the administrative password. The exploitation condition is tied to firmware version V3.60 specifically. No authentication, no user interaction, and no non-default configuration are required - the behavior appears inherent to the affected firmware's DS JSON API and Streamd Digest handling. The principal limiting factor is the adjacent-network requirement; impact is confined to credential/crypto disclosure and unauthorized viewing of encrypted media sessions, with no stated integrity or availability effect.

This is a moderate-severity authentication bypass (CWE-287) in the TP-Link Tapo C210 V3.60 IP camera, rated CVSS 4.0 7.1 with vector CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. The single most important risk-limiting signal is the Adjacent (AV:A) attack vector: exploitation is NOT internet-wide/remote - the attacker must already be on the same logical network segment (e.g., the Wi-Fi LAN the camera is attached to), which substantially narrows the realistic threat population versus a true AV:N flaw. Offsetting this, the attack requires no privileges (PR:N, unauthenticated), no user interaction (UI:N), and low complexity (AC:L), so once an attacker has adjacent access the barrier to exploitation is minimal. Impact is confidentiality-only (VC:H, with VI/VA:N): disclosure of shared credential and cryptographic material and unauthorized access to encrypted media (video) sessions - there is no indication of device takeover, firmware modification, or denial of service. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the absence of these signals means the probability of widespread automated exploitation is currently low, and the primary concern is targeted privacy compromise by an attacker with local network foothold. Note a minor tension to verify: the input CVSS 4.0 score of 7.1 is HIGH, but the adjacent-only, confidentiality-only impact profile makes the real-world urgency lower than the raw number suggests for networks where the camera is not exposed to untrusted adjacent hosts.

An attacker who has gained a foothold on the same local/Wi-Fi network as a Tapo C210 V3.60 camera sends unauthenticated DS JSON API requests to the device and harvests the exposed shared credential and cryptographic metadata. Because the Streamd Digest authentication mechanism accepts that shared credential as an administrative password, the attacker then establishes an encrypted media session and views the camera's video feed without ever knowing the real account password. No public exploit code was identified at time of analysis, but the low attack complexity (AC:L) and lack of authentication make this straightforward to reproduce for anyone with adjacent network access.