Tapo C210 V3 6
Monthly
Improper authentication (CWE-287) in TP-Link Tapo C210 V3.60 firmware lets an attacker positioned on the same adjacent network retrieve shared credential material and cryptographic metadata by sending unauthenticated DS JSON API requests to the camera, without any credentials or user interaction. The recovered shared credential is then accepted by the Streamd Digest authentication mechanism as the administrative password, so the attacker can establish encrypted media sessions and view the camera's protected streams without ever knowing the device account password. Impact is confined to confidentiality - high credential/crypto disclosure and unauthorized media-session access - with no integrity or availability effect cited; exploitation requires local LAN/Wi-Fi adjacency and is not reachable directly from the internet, and no public exploit code or CISA KEV entry was identified at time of analysis.
Authentication bypass in the TP-Link Tapo C210 V3.60 DS JSON API allows attackers on the adjacent network to execute protected camera operations, including pan-tilt-zoom (PTZ) control, without a valid authenticated session. The flaw is rated moderate severity (CVSS 5.3; CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) because exploitation is confined to the same LAN/Wi-Fi segment and the impact is limited to camera functionality manipulation rather than full device takeover. No public exploit code was identified at time of analysis, and CISA KEV status does not indicate active exploitation; TP-Link has released patched firmware.
Improper authentication (CWE-287) in TP-Link Tapo C210 V3.60 firmware lets an attacker positioned on the same adjacent network retrieve shared credential material and cryptographic metadata by sending unauthenticated DS JSON API requests to the camera, without any credentials or user interaction. The recovered shared credential is then accepted by the Streamd Digest authentication mechanism as the administrative password, so the attacker can establish encrypted media sessions and view the camera's protected streams without ever knowing the device account password. Impact is confined to confidentiality - high credential/crypto disclosure and unauthorized media-session access - with no integrity or availability effect cited; exploitation requires local LAN/Wi-Fi adjacency and is not reachable directly from the internet, and no public exploit code or CISA KEV entry was identified at time of analysis.
Authentication bypass in the TP-Link Tapo C210 V3.60 DS JSON API allows attackers on the adjacent network to execute protected camera operations, including pan-tilt-zoom (PTZ) control, without a valid authenticated session. The flaw is rated moderate severity (CVSS 5.3; CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) because exploitation is confined to the same LAN/Wi-Fi segment and the impact is limited to camera functionality manipulation rather than full device takeover. No public exploit code was identified at time of analysis, and CISA KEV status does not indicate active exploitation; TP-Link has released patched firmware.