Tapo C325Wb V2
Monthly
Predictable pre-shared key generation in the TP-Link Tapo C325WB V2 camera's local media streaming service allows an unauthenticated attacker on the adjacent network to recover the key and authenticate to the stream without credentials. This enables access and takeover of live video and audio feeds, compromising confidentiality and integrity. The vulnerability is rated 8.7 (High) with no public exploit identified at time of analysis; a vendor firmware patch is available.
TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass in its HTTPS JSON API dispatcher that allows an attacker on the adjacent network to append an onboarding-scoped object to a JSON request and thereby skip session verification, invoking privileged actions without credentials. Successful exploitation can expose live video and audio, modify device settings, and disclose sensitive device information or secrets. The vendor has released patched firmware, no public exploit code was identified at time of analysis, and independent assessment rates the issue high severity under CVSS 3.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with the adjacent-network requirement the primary limiting factor.
Unauthenticated denial of service in the TP-Link Tapo C325WB v2 camera allows a crafted pair of RTSP-over-HTTP tunneling requests sent to the streaming service on TCP port 554 to corrupt memory (stack-based buffer overflow, CWE-121) and crash the streaming daemon, disrupting live video and related streaming functions until the daemon recovers or restarts. Only cameras with the optional Camera Account feature enabled are exposed, and the attacker must be positioned on the same adjacent network segment (Wi-Fi or LAN) as the camera, since the assessed vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; no authentication or user interaction is required. Impact is availability-only and temporary, no public exploit identified at time of analysis, and a vendor patch is available per the TP-Link firmware release notes and advisory FAQ 5333.
Predictable pre-shared key generation in the TP-Link Tapo C325WB V2 camera's local media streaming service allows an unauthenticated attacker on the adjacent network to recover the key and authenticate to the stream without credentials. This enables access and takeover of live video and audio feeds, compromising confidentiality and integrity. The vulnerability is rated 8.7 (High) with no public exploit identified at time of analysis; a vendor firmware patch is available.
TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass in its HTTPS JSON API dispatcher that allows an attacker on the adjacent network to append an onboarding-scoped object to a JSON request and thereby skip session verification, invoking privileged actions without credentials. Successful exploitation can expose live video and audio, modify device settings, and disclose sensitive device information or secrets. The vendor has released patched firmware, no public exploit code was identified at time of analysis, and independent assessment rates the issue high severity under CVSS 3.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with the adjacent-network requirement the primary limiting factor.
Unauthenticated denial of service in the TP-Link Tapo C325WB v2 camera allows a crafted pair of RTSP-over-HTTP tunneling requests sent to the streaming service on TCP port 554 to corrupt memory (stack-based buffer overflow, CWE-121) and crash the streaming daemon, disrupting live video and related streaming functions until the daemon recovers or restarts. Only cameras with the optional Camera Account feature enabled are exposed, and the attacker must be positioned on the same adjacent network segment (Wi-Fi or LAN) as the camera, since the assessed vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; no authentication or user interaction is required. Impact is availability-only and temporary, no public exploit identified at time of analysis, and a vendor patch is available per the TP-Link firmware release notes and advisory FAQ 5333.