Hard-coded RSA Key Vulnerability in TP-Link Tapo C500 Cameras

CVE-2025-1099

Summary

The TP-Link Tapo C500 Wi-Fi security cameras, namely versions V1 and V2, are vulnerable due to a hard-coded RSA private key embedded in their firmware. This flaw allows an attacker with physical access to the device to extract these cryptographic keys. Once compromised, these keys can facilitate impersonation attacks, enable data decryption, and allow for man-in-the-middle attacks against the vulnerable device, posing significant risks to the integrity and security of surveillance operations.

References