CVE-2026-105674

Received Received - Intake

Predictable Pre-Shared Key in TP-Link Tapo C325WB V2

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: TPLink

Description

TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator, making the key predictable and recoverable. An unauthenticated attacker on the adjacent network can recover the key and authenticate to the media streaming service without valid user credentials. Successful exploitation may allow an unauthenticated adjacent-network attacker to access and take over live video and audio streams, compromising the confidentiality and integrity of camera media.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-105674

EUVD

EUVD-2026-95406

Affected Vendors & Products

Vendor	Product	Version / Range
TP-Link	Systems	Inc. Tapo C325WB v2 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-330	The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Attack-Flow Graph

Executive Summary

The TP-Link Tapo C325WB V2 camera uses a predictable pre-shared key for its local media streaming service, generated with a time-seeded pseudo-random number generator. This makes the key easy to guess or recover by an attacker on the same network. The attacker can then authenticate to the streaming service without valid credentials.

Detection Guidance

Detection requires identifying unauthorized access to the media streaming service on TP-Link Tapo C325WB V2 devices. Monitor network traffic for unexpected connections to the camera's local streaming service. Check device logs for unusual authentication attempts or media access patterns. Since the vulnerability allows unauthenticated access, inspect network logs for connections without valid credentials.

Impact Analysis

An attacker could access live video and audio streams from your camera, compromising your privacy. They might view sensitive footage or even take control of the camera, potentially using it to monitor your activities without your knowledge.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating privacy requirements under GDPR and HIPAA. Organizations using affected cameras may face compliance breaches, legal penalties, and reputational damage due to compromised data confidentiality.

Mitigation Strategies

Disable the media streaming service on the TP-Link Tapo C325WB V2 if not required. Update the device firmware to the latest version if a patch is available. Ensure the device is not accessible from untrusted networks.

Hi! I’m here to help you understand CVE-2026-105674. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70