CVE-2026-105815: CWE-287 Improper Authentication in TP-Link Systems Inc. Tapo C210 v3.6
Description
TP-Link Tapo C210 version 3.6 has an improper authentication vulnerability where shared credential material and cryptographic metadata are exposed via unauthenticated DS JSON API requests. This exposure allows an attacker on an adjacent network to use the shared credential as an administrative password through the Streamd Digest authentication mechanism. Exploitation can lead to unauthorized establishment of encrypted media sessions without knowing the device account password.
CVSS v4.0
Score 7.1high
Affected software
TP-Link Systems Inc.
Tapo C210 v3.6
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-105815 describes an improper authentication vulnerability (CWE-287) in TP-Link Tapo C210 firmware version 3.6. The device exposes shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative password, enabling an unauthenticated attacker on an adjacent network to establish encrypted media sessions without the device account password. This vulnerability allows disclosure of credential and cryptographic material and unauthorized access to encrypted media sessions.
Potential Impact
Successful exploitation discloses shared credentials and cryptographic metadata, allowing an unauthenticated adjacent-network attacker to bypass authentication and establish encrypted media sessions with administrative privileges. This compromises the confidentiality and integrity of media streams and device access controls.
Mitigation Recommendations
No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to trusted users and networks to prevent adjacent-network attackers from exploiting this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- TPLink
- Date Reserved
- 2026-10-05T21:22:06.900Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad6906e2cdf04f656950187
Added to database: 10/19/2026, 21:49:34 UTC
Last enriched: 10/19/2026, 22:03:28 UTC
Last updated: 10/19/2026, 22:08:18 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.