TP-Link Tapo C210 Credential Exposure Allows Unauthorized Media-Session Access
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The Streamd Digest authentication mechanism accepts the exposed shared credential as an administrative password (CWE-287, Improper Authentication). An unauthenticated attacker on an adjacent network can establish encrypted media sessions without the device account password. Successful exploitation may disclose credential and cryptographic material and allow unauthorized access to encrypted media sessions.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
Description from the CNA
TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative password, allowing an unauthenticated adjacent-network attacker to establish encrypted media sessions without knowledge of the device account password. Successful exploitation may disclose credential and cryptographic material and allow unauthorized access to encrypted media sessions.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Install firmware V3.6_1.2.7 Build 260818, the version that fixes this issue. Firmware before that build is affected.
Written with Claude Haiku 5.5 from the sources below · 2026-10-28
- Fix · CNA Tapo C210 v3.6 (TP-Link Systems Inc.) Fixed in V3.6_1.2.7 Build 260818
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
TP-Link Systems Tapo C210 v3.6 — tp-link.com/us/support/faq/5352
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-76549 Authentication bypass in TP-Link Tapo C210 DS JSON APIPriority LOW 24
Timeline
- 2026-10-20 Threatist record created from CVE-2026-105815
- 2026-10-20 Alias added: GHSA-j2hx-4c2v-47j3
- 2026-10-20 CISA SSVC decision points changed
- 2026-10-20 Priority changed: MEDIUM → LOW
References
More TP-Link vulnerabilities
- TI-2023-16571 TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain… KEVCVSS 3.1HIGH 8.8
- TI-2023-01313 Command injection in TP-Link Archer AX21 KEVCVSS 3.1HIGH 8.8
- TI-2020-14907 TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the… KEVCVSS 3.1HIGH 8.8
- TI-2025-08589 Authenticated RCE via Parental Control command injection KEVCVSS 4.0HIGH 8.6
- TI-2015-02672 Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317… KEVCVSS 3.1HIGH 7.5
- TI-2023-27456 Authentication bypass by spoofing in TP-Link TL-WR841N KEVCVSS 3.1MEDIUM 6.5
Sources
- CVE-2026-105815 · CVE Program
- CVE-2026-105815 · NVD
- FIRST EPSS
- GHSA-j2hx-4c2v-47j3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences