CVE-2026-105815
7.1HighPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-287
Impact
Adjacent network attackers can hijack encrypted media sessions and read camera streams without knowing the device account password. They only need local network access to issue unauthenticated requests to the camera's DS JSON API.
Root cause
The DS JSON API leaks shared credential material and cryptographic metadata without authentication, and the Streamd service accepts this leaked credential as an administrative digest password.
Affected systems
TP-Link Tapo C210 V3.60.
CVSS v4.0 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade device firmware to the latest release following the vendor release notes. As an interim mitigation, isolate the camera on a dedicated VLAN with strict firewall rules to block adjacent untrusted network access.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative password, allowing an unauthenticated adjacent-network attacker to establish encrypted media sessions without knowledge of the device account password. Successful exploitation may disclose credential and cryptographic material and allow unauthorized access to encrypted media sessions.