42 matches found
EUVD-2026-104643
TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera...
EUVD-2026-104644
TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative password, allowing an unauthenticated...
CVE-2026-105814
TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera...
CVE-2026-105815
TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative password, allowing an unauthenticated...
CVE-2026-105815 Credential Material Exposure Leading to Unauthorized Streamed Media-Session Access in TP-Link Tapo C210
TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative password, allowing an unauthenticated...
CVE-2026-105815
The TP-Link Tapo C210 (V3.60) is vulnerable to an Improper Authentication flaw (CWE-287) where unauthenticated DS JSON API requests expose shared credential material and cryptographic metadata. An unauthenticated attacker on an adjacent network can leverage this exposed material as an administrat...
CVE-2026-105814
The TP-Link Tapo C210 (V3.60) contains an authentication bypass vulnerability within the DS JSON API . The root cause is an order-dependent flaw where a crafted JSON request combining a protected operation with public onboarding-related fields causes inconsistent module-level authorization checks...
CVE-2026-105814 Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210
TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera...
PT-2026-117663
Name of the Vulnerable Software and Affected Versions TP-Link Tapo C210 version 3.60 Description Unauthenticated DS JSON API requests may expose shared credential material and cryptographic metadata. This shared credential can be accepted by the Streamd Digest authentication mechanism as an...
CVE-2026-0919: Improper Input Validation
The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively long URL path. An invalid‑URL error path continues into cleanup code that assumes allocated buffers exist, leading to a crash and service restart. An unauthenticated attacker can...
CVE-2025-14553
Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force the password in the local network. Issue can be mitigated through mobile application updates. Device firmware remains unchanged...
EUVD-2025-203829
Exposure of password hashes through an unauthenticated API response in TP-Link Tapo C210 V.1.8 app on iOS and Android, allowing attackers to brute force the password in the local network. Issue can be mitigated through mobile application updates. Device firmware remains unchanged...
CVE-2025-14553
Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force the password in the local network. Issue can be mitigated through mobile application updates. Device firmware remains unchanged...
CVE-2025-14553 Password Hash Leak Could Lead to Unauthorized Access on Tapo App via Local Network
Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force the password in the local network. Issue can be mitigated through mobile application updates. Device firmware remains unchanged...
CVE-2025-14553 Password Hash Leak Could Lead to Unauthorized Access on Tapo App via Local Network
Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force the password in the local network. Issue can be mitigated through mobile application updates. Device firmware remains unchanged...
CVE-2025-14553
Summary: CVE-2025-14553 concerns TP-Link Tapo mobile apps (iOS/Android) exposing password hashes via an unauthenticated API response, enabling attackers on the local network to brute-force credentials. Multiple connected sources confirm: affected product scope includes TP-Link Tapo cameras; impac...
PT-2025-51777
Name of the Vulnerable Software and Affected Versions TP-Link Tapo C210 versions 1.8 Description An unauthenticated API response exposes password hashes in the TP-Link Tapo C210 application on iOS and Android. This allows attackers to attempt to brute force the password within the local network...
TP-LINK Tapo C210 security vulnerabilities
TP-LINK Tapo C210 is a webcam device from China P&L TP-LINK. A security vulnerability exists in TP-Link Tapo C210 version V.1.8, which originates from an unauthenticated API response exposing a password hash, which could lead to a brute force cracking attack...