Tapo S505 V1 6
Monthly
Tapo S505 v1.6 firmware stores device-specific cryptographic material in plaintext within nonvolatile storage, allowing an attacker with physical access to recover those secrets, for example by dumping the flash memory. The issue is classified as CWE-312 and has a CVSS 4.0 base score of 5.4; the independent assessment rates it as a medium-to-low real-world priority because exploitation is bounded by the physical-access requirement (AV:P) and downstream unauthorized access is only a conditional risk. The vendor has a patch available, and no public exploit code was identified at time of analysis.
Tapo S505 v1.6 firmware stores device-specific cryptographic material in plaintext within nonvolatile storage, allowing an attacker with physical access to recover those secrets, for example by dumping the flash memory. The issue is classified as CWE-312 and has a CVSS 4.0 base score of 5.4; the independent assessment rates it as a medium-to-low real-world priority because exploitation is bounded by the physical-access requirement (AV:P) and downstream unauthorized access is only a conditional risk. The vendor has a patch available, and no public exploit code was identified at time of analysis.