Read the docs
TI-2026-26447 Aliases CVE-2026-34126GHSA-p93f-7gcr-x8pr

Bluetooth Communication Uses Unencrypted Transmission During Initial Setup on TP-Link's Tapo L535E, P300 and D100C

Priority LOW 33CWE-319Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-319.

Summary

TP-Link has identified a vulnerability in Tapo L535E v1.0 and v3.0, Tapo P300 v1.0, and Tapo D100C v1.0, where Bluetooth communication during the initial setup phase is transmitted in cleartext without encryption. Bluetooth is only used during initialization. An attacker within the Bluetooth range could exploit this behavior using Bluetooth sniffing or man-in-the-middle techniques, which may allow eavesdropping on Bluetooth communication, manipulate transmitted setup data and potentially gain unauthorized control of the device during initialization.  An attacker within the Bluetooth range could exploit this behavior using Bluetooth sniffing or man-in-the-middle techniques, which may allow eavesdropping on Bluetooth communication, manipulate transmitted setup data and potentially gain unauthorized control of the device during initialization. D100C is the chime delivered with your Tapo camera, and it is delivered with the following Tapo products: D130, D210, D235, D225, TD21, TDB21 and TD25

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00097 0th percentileScored 2026-11-07
Fix Fixed Tapo L535E v1.0, v3.0 (TP-Link Systems Inc.): 1.4.1 Build 251016 Rel.204554Tapo P300 v1.0 (TP-Link Systems Inc.): EU_1.4.2 Build 251219 Rel.142654, JP_1.4.0 Build 260416 Rel.014037+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkTapo L535E v1.0, v3.0before 1.4.1 Build 251016 Rel.2045541.4.1 Build 251016 Rel.204554Patch availableCNA
TP-LinkTapo P300 v1.0before EU_1.4.2 Build 251219 Rel.142654; before JP_1.4.0 Build 260416 Rel.014037EU_1.4.2 Build 251219 Rel.142654, JP_1.4.0 Build 260416 Rel.014037Patch availableCNA
TP-LinkTapo D100C v1.0before 1.3.1 Build 260421 Rel.0316581.3.1 Build 260421 Rel.031658Patch availableCNA
  • Tapo L535E v1.0, v3.0 VendorTP-Link Affected before 1.4.1 Build 251016 Rel.204554 Fixed in 1.4.1 Build 251016 Rel.204554 Patch available CNA
  • Tapo P300 v1.0 VendorTP-Link Affected before EU_1.4.2 Build 251219 Rel.142654; before JP_1.4.0 Build 260416 Rel.014037 Fixed in EU_1.4.2 Build 251219 Rel.142654, JP_1.4.0 Build 260416 Rel.014037 Patch available CNA
  • Tapo D100C v1.0 VendorTP-Link Affected before 1.3.1 Build 260421 Rel.031658 Fixed in 1.3.1 Build 260421 Rel.031658 Patch available CNA

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:tapo_l535e_firmware:1.4.1:*:*:*:*:*:*:*1.4.1VulnerableTP-Link
cpe:2.3:h:tp-link:tapo_l535e:1.0:*:*:*:*:*:*:*1.0Running onTP-Link
cpe:2.3:h:tp-link:tapo_l535e:3.0:*:*:*:*:*:*:*3.0Running onTP-Link
cpe:2.3:o:tp-link:tapo_p300_firmware:1.4.0:*:*:*:*:*:*:*1.4.0VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_p300_firmware:1.4.2:*:*:*:*:*:*:*1.4.2VulnerableTP-Link
cpe:2.3:h:tp-link:tapo_p300:1.0:*:*:*:*:*:*:*1.0Running onTP-Link
cpe:2.3:o:tp-link:tapo_d100c_firmware:1.3.1:*:*:*:*:*:*:*1.3.1VulnerableTP-Link
cpe:2.3:h:tp-link:tapo_d100c:1.0:*:*:*:*:*:*:*1.0Running onTP-Link
  • cpe:2.3:o:tp-link:tapo_l535e_firmware:1.4.1:*:*:*:*:*:*:* Versions 1.4.1 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:tapo_l535e:1.0:*:*:*:*:*:*:* Versions 1.0 Running on ·TP-Link
  • cpe:2.3:h:tp-link:tapo_l535e:3.0:*:*:*:*:*:*:* Versions 3.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:tapo_p300_firmware:1.4.0:*:*:*:*:*:*:* Versions 1.4.0 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_p300_firmware:1.4.2:*:*:*:*:*:*:* Versions 1.4.2 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:tapo_p300:1.0:*:*:*:*:*:*:* Versions 1.0 Running on ·TP-Link
  • cpe:2.3:o:tp-link:tapo_d100c_firmware:1.3.1:*:*:*:*:*:*:* Versions 1.3.1 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:tapo_d100c:1.0:*:*:*:*:*:*:* Versions 1.0 Running on ·TP-Link

Remediation

  • Fix · CNA Tapo L535E v1.0, v3.0 (TP-Link Systems Inc.) Fixed in 1.4.1 Build 251016 Rel.204554
  • Fix · CNA Tapo P300 v1.0 (TP-Link Systems Inc.) Fixed in EU_1.4.2 Build 251219 Rel.142654, JP_1.4.0 Build 260416 Rel.014037
  • Fix · CNA Tapo D100C v1.0 (TP Link Systems Inc.) Fixed in 1.3.1 Build 260421 Rel.031658

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34126
  2. 2026-10-03 Alias added: GHSA-p93f-7gcr-x8pr

References

Patch 5

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences