Tapo Cloud Service
Monthly
Server-side request forgery in the Tapo Cloud MQTT proxy allows remote attackers to make TP-Link's cloud backend issue requests to a host they control, because the proxy accepts a user-controlled host value without sufficient input validation. The exposure sits in the vendor-operated Tapo Cloud service rather than in customer firmware, and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) indicates no privileges or user interaction are needed while confidentiality impact and scope change carry the most weight; TP-Link itself reported the flaw. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and vuln.today tracks it as a 'this_week' priority rather than an emergency, with the vendor's high attack-complexity rating whose cause is not described in the available sources acting as the main limiting factor.
Tapo Cloud's MQTT broker fails to bind a proxy token request to the authenticated device, so an attacker who owns an authenticated Tapo device and knows another device's ID can obtain a token scoped to that victim and upload content into the victim's Tapo Cloud storage, where it may appear as a legitimate Tapo event. The flaw is in the cloud service itself (CWE-862), and the independent assessment rates it CVSS 3.1 8.3 with an authenticated attacker-owned device as a prerequisite. No public exploit was identified at time of analysis.
Server-side request forgery in the Tapo Cloud MQTT proxy allows remote attackers to make TP-Link's cloud backend issue requests to a host they control, because the proxy accepts a user-controlled host value without sufficient input validation. The exposure sits in the vendor-operated Tapo Cloud service rather than in customer firmware, and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) indicates no privileges or user interaction are needed while confidentiality impact and scope change carry the most weight; TP-Link itself reported the flaw. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and vuln.today tracks it as a 'this_week' priority rather than an emergency, with the vendor's high attack-complexity rating whose cause is not described in the available sources acting as the main limiting factor.
Tapo Cloud's MQTT broker fails to bind a proxy token request to the authenticated device, so an attacker who owns an authenticated Tapo device and knows another device's ID can obtain a token scoped to that victim and upload content into the victim's Tapo Cloud storage, where it may appear as a legitimate Tapo event. The flaw is in the cloud service itself (CWE-862), and the independent assessment rates it CVSS 3.1 8.3 with an authenticated attacker-owned device as a prerequisite. No public exploit was identified at time of analysis.