CVE-2023-27126
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
In the TP-Link TAPO C200 V3 (EU) camera with firmware 1.1.22 Build 220725, the AES Key-IV pair is shared across all devices. An attacker with physical access to the camera can extract and decrypt sensitive data, including the WiFi password and TP-Link account credentials of the victim.
Risk Assessment
The risk involves potential compromise of the victim's WiFi network and TP-Link account by an attacker with physical access to the camera. This could lead to unauthorized access to the home or corporate network and identity theft.
Recommendation
It is recommended to immediately update the camera firmware to the latest version and change the WiFi password and TP-Link account password. Where possible, restrict physical access to the device.
Original NVD description (English source)
The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused across all cameras. An attacker with physical access to a camera is able to extract and decrypt sensitive data containing the Wifi password and the TP-LINK account credential of the victim.