CVE-2026-102368

Deferred Deferred - Pending Action

Plaintext Cryptographic Material Exposure in Tapo Device Firmware

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: TPLink

Description

Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physical access to an affected device can recover this sensitive material from the firmware. Successful exploitation of this vulnerability may result in the disclosure of device-specific cryptographic material and could, under certain conditions, increase the risk of unauthorized access to related protected information or communications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-102368

Affected Vendors & Products

Vendor	Product	Version / Range
TP-Link	System	Inc. Tapo S505 v1.6 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability involves Tapo device firmware storing device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physical access can recover this sensitive data directly from the firmware.

Detection Guidance

This vulnerability requires physical access to the device to extract cryptographic material from firmware. No network-based detection commands are applicable. Inspect the device firmware directly if physical access is possible.

Impact Analysis

Exploitation may lead to disclosure of cryptographic material, potentially increasing the risk of unauthorized access to protected information or communications. Physical access to the device is required for exploitation.

Compliance Impact

This vulnerability may lead to the disclosure of cryptographic material, which could increase the risk of unauthorized access to protected information or communications. This could potentially violate compliance requirements under GDPR or HIPAA if such access results in unauthorized data exposure or breaches of confidentiality.

Mitigation Strategies

Since the issue involves plaintext storage of cryptographic material in firmware, mitigation requires updating the device firmware to a patched version if available. Contact the vendor for updates and avoid exposing devices to unauthorized physical access.

Hi! I’m here to help you understand CVE-2026-102368. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70