CVE-2023-27126

4.6MEDIUM

Key Information:

Vendor
Tp-link
Status
Tapo C200 Firmware
Vendor
CVE Published:
6 June 2023

Summary

The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused across all cameras. An attacker with physical access to a camera is able to extract and decrypt sensitive data containing the Wifi password and the TP-LINK account credential of the victim.

References

http://tp-link.com
http://tapo.com
https://www.claranet.fr/blog/dans-les-entrailles-dune-cam...

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.