Authentication Bypass in TP-Link Tapo C210

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: TPLink

Description

TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera operations, including pan-tilt-zoom control, to be executed without a valid authenticated session. Successful exploitation may allow an unauthenticated attacker on the adjacent network to perform protected camera operations, including pan-tilt-zoom (PTZ) control, without a valid authenticated session. This could result in unauthorized manipulation of camera functionality.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-105814

Affected Vendors & Products

Vendor	Product	Version / Range
TP-Link	Systems	Inc. Tapo C210 v3.6 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

TP-Link Tapo C210 V3.60 has an authentication bypass flaw in its DS JSON API. A specially crafted JSON request with both protected operations and public onboarding fields can bypass module-level authorization checks. This allows unauthenticated users to execute protected camera functions like pan-tilt-zoom control without a valid session.

Impact Analysis

An attacker on the same network could manipulate the camera without authentication. This includes unauthorized pan-tilt-zoom control, potentially allowing surveillance of private areas or disabling the camera's security features.

Mitigation Strategies

Update the TP-Link Tapo C210 camera firmware to the latest version to address the authentication bypass vulnerability in the DS JSON API.

Hi! I’m here to help you understand CVE-2026-105814. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70