Authentication Bypass Vulnerability in TP-Link Tapo C210
CVE-2026-105815

7.1HIGH

Key Information:

Vendor

Tp-link Systems Inc.

Status
Tapo C210 V3.6
Vendor
CVE Published:
19 October 2026

What is CVE-2026-105815?

The TP-Link Tapo C210 version V3.60 contains a vulnerability that may allow unauthenticated attackers to exploit shared credential material and cryptographic metadata via DS JSON API requests. This can lead to unauthorized access through the Streamed Digest authentication mechanism, enabling attackers to establish encrypted media sessions without requiring the device account password. Successfully exploiting this vulnerability could lead to the exposure of sensitive credentials and cryptographic information, compromising the security of the media sessions.

Affected Version(s)

Tapo C210 v3.6 0

References

https://www.tp-link.com/us/support/download/tapo-c210/#Fi...
patch
https://www.tp-link.com/us/support/faq/5352/
vendor-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.