Firmware Vulnerability in TP-Link Tapo Device Impacting User Security
CVE-2026-102368

5.4MEDIUM

Key Information:

Vendor

Tp-link System Inc.

Status
Tapo S505 V1.6
Vendor
CVE Published:
8 October 2026

What is CVE-2026-102368?

The firmware of affected TP-Link Tapo devices unnecessarily stores critical cryptographic material in plaintext format within nonvolatile storage. This design flaw allows an attacker with physical access to the device to recover sensitive keys or tokens, which could lead to unauthorized access to secure communications and personal information. Users are urged to ensure their devices are updated to the latest firmware version to mitigate potential risks associated with this vulnerability.

Affected Version(s)

Tapo S505 v1.6 0 < 1.4.1 Build 260713

References

https://www.tp-link.com/us/support/download/tapo-s505/#Fi...
patch
https://www.tp-link.com/us/support/faq/5332/
vendor-advisory

CVSS V4

Score:
5.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.