Tapo C325WB EUVD-2026-95406

The attacker must be positioned on the adjacent network (same LAN or Wi-Fi broadcast domain as the camera, per AV:A) and the device's local media streaming service must be in use; the service's pre-shared key must be generated by the vulnerable time-seeded PRNG, which makes it predictable and brute-forceable within a constrained keyspace. No valid user credentials or user interaction are required (PR:N/UI:N). The primary limiting factor is the adjacent-network requirement: the flaw is not exploitable from the internet and requires the attacker to first obtain a foothold on the local network segment; patched firmware from TP-Link removes the predictable key generation.

The provided CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 8.7 HIGH) is internally consistent with the description: a predictable, time-seeded PRNG key (CWE-330) that an unauthenticated attacker on the adjacent network can recover and replay to authenticate to the local media streaming service. The attack vector is Adjacent (AV:A), not Network, so exploitation requires a foothold on the same LAN/Wi-Fi segment as the camera - this is the single most important factor bounding real-world risk and sharply reduces the internet-wide attack surface. No EPSS score, no CISA KEV listing, and no POC were provided, so exploitation is 'no public exploit identified at time of analysis'; there is no evidence of active or widespread exploitation. Net: this is a genuine, low-complexity authentication bypass against a consumer camera with high confidentiality/integrity impact, but the adjacent-network constraint and absence of exploitation signals make it a patch-soon issue for exposed/shared networks rather than an emergency mass-exploitation threat. One minor inconsistency: the vendor vector sets VA:H (availability) while the description only cites confidentiality and integrity of camera media - verify whether stream takeover genuinely denies availability.

An attacker who has gained access to the same local/Wi-Fi network as a Tapo C325WB V2 (e.g., a guest network, a compromised IoT device, or an untrusted shared LAN) reconstructs the time-seeded PRNG keyspace to derive the pre-shared key for the camera's local media streaming service. Using the recovered key, the attacker authenticates without any valid user credentials and gains live access to the video and audio feeds. No public exploit code was identified at time of analysis, so this scenario assumes attacker-developed tooling.