CVE-2026-105815

Received Received - Intake

Unauthenticated Credential Exposure in TP-Link Tapo C210

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: TPLink

Description

TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative password, allowing an unauthenticated adjacent-network attacker to establish encrypted media sessions without knowledge of the device account password. Successful exploitation may disclose credential and cryptographic material and allow unauthorized access to encrypted media sessions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-10-19

Generated

2026-10-20

AI Q&A

2026-10-20

EPSS Evaluated

N/A

NVD

CVE-2026-105815

Affected Vendors & Products

Vendor	Product	Version / Range
TP-Link	Systems	Inc. Tapo C210 v3.6 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

TP-Link Tapo C210 V3.60 has a vulnerability where unauthenticated requests to its DS JSON API can expose shared credential material and cryptographic metadata. This exposed credential can be used as an administrative password in Streamd Digest authentication, allowing attackers to establish encrypted media sessions without knowing the actual device password.

Impact Analysis

An attacker could exploit this to gain unauthorized access to encrypted media sessions on your TP-Link Tapo C210 camera. They could view or intercept video feeds without needing the device's account password, potentially compromising your privacy and security.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive video data, violating privacy requirements under GDPR and HIPAA. Organizations using this device may fail compliance audits due to insufficient protection of personal or health-related data.

Mitigation Strategies

Immediately update the TP-Link Tapo C210 firmware to the latest version to address the unauthenticated DS JSON API exposure. Disable unauthenticated API access if possible and restrict network access to the device to trusted adjacent networks only.

Hi! I’m here to help you understand CVE-2026-105815. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70