Authentication Bypass Vulnerability in TP-Link Tapo C210 Cameras

CVE-2026-105814

What is CVE-2026-105814?

The TP-Link Tapo C210 camera version V3.60 is susceptible to an authentication bypass vulnerability via its DS JSON API. An attacker on the adjacent network can exploit this flaw by sending a specially crafted JSON request. This request may combine protected operations with public onboarding fields, leading to inconsistent application of authorization checks. Ultimately, this may enable the attacker to execute sensitive camera functions, such as pan-tilt-zoom (PTZ) control, without needing valid authentication, which compromises the camera's security and functionality.

References