CVE-2026-105815
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative password, allowing an unauthenticated adjacent-network attacker to establish encrypted media sessions without knowledge of the device account password.
Risk Assessment
This may lead to disclosure of credential and cryptographic material and unauthorized access to encrypted media sessions. It poses a serious risk to confidentiality and integrity of transmissions.
Recommendation
Update the device firmware to the latest version. Restrict API access from untrusted networks and monitor for unusual sessions.
Other vulnerabilities in TP-Link Tapo C210
Original NVD description (English source)
TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative password, allowing an unauthenticated adjacent-network attacker to establish encrypted media sessions without knowledge of the device account password. Successful exploitation may disclose credential and cryptographic material and allow unauthorized access to encrypted media sessions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS