TI-2026-69751 Aliases CVE-2026-102368

Plaintext storage of device private key in Tapo S505 firmware

LOW 25CWE-312Published 2026-10-08 · Updated 2026-10-09

Key facts

Attack vector: Physical
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-312.

Summary

TP-Link Tapo S505 v1.6 firmware before 1.4.1 Build 260713 stores device-specific cryptographic material in plaintext in nonvolatile storage, classified as CWE-312. An attacker with physical access to an affected device can recover this material from the firmware. Successful exploitation may disclose device-specific cryptographic material and could, under certain conditions, increase the risk of unauthorized access to related protected information or communications.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physical access to an affected device can recover this sensitive material from the firmware. Successful exploitation of this vulnerability may result in the disclosure of device-specific cryptographic material and could, under certain conditions, increase the risk of unauthorized access to related protected information or communications.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00103 0th percentileScored 2026-11-07

Fix Fixed Tapo S505 v1.6 (TP-Link System Inc.): 1.4.1 Build 260713

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TP-Link System Inc.	Tapo S505 v1.6	before 1.4.1 Build 260713	1.4.1 Build 260713	Patch available	CNA

Tapo S505 v1.6 VendorTP-Link System Inc. Affected before 1.4.1 Build 260713 Fixed in 1.4.1 Build 260713 Patch available CNA

Remediation

Update Tapo S505 v1.6 firmware to 1.4.1 Build 260713.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Fix · CNA Tapo S505 v1.6 (TP-Link System Inc.) Fixed in 1.4.1 Build 260713

Timeline

2026-10-09 Threatist record created from CVE-2026-102368
2026-10-09 CISA SSVC decision points changed
2026-10-09 Priority changed: MEDIUM → LOW

References

Patch 1

https://www.tp-link.com/us/support/download/tapo-s505/#Firmware-Release-Notes

Advisory 1

https://www.tp-link.com/us/support/faq/5332/

TI-2026-65319 Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration CVSS 4.0HIGH 8.5
TI-2026-56252 Unauthenticated Account Information Disclosure in Multiple Omada Controllers CVSS 4.0MEDIUM 6.9
TI-2026-74509 Missing authorization in TP-Link Omada Controller MSP mode CVSS 4.0HIGH 7.5
TI-2025-10706 UPnP DOS in TL-WR940N V6 CVSS 4.0HIGH 7.1
TI-2026-53559 Pre-Authentication Multipart Boundary Buffer Overflow in HTTP Service in TP-Link TL-WR841N CVSS 4.0MEDIUM 5.3
TI-2026-53558 Pre-Authentication NULL Pointer Dereference in UPnP SOAP State Variable Query Processing in TP-Link TL-WR841N CVSS 4.0MEDIUM 5.3

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences