Reused AES Key-IV Pair in TP-Link TAPO C200 Camera Firmware

CVE-2023-27126

Summary

The TP-Link TAPO C200 camera has a security flaw where the AES Key-IV pair is reused across all devices running the affected firmware version. This weakness means that if an attacker gains physical access to a camera, they can extract encrypted sensitive data, including the victim's Wi-Fi password and TP-Link account credentials. This presents a significant risk, especially in environments where cameras are easily accessible. Users of this camera model are urged to secure their devices and monitor for any unauthorized access.

References