CVE-2026-34126 describes a cleartext transmission vulnerability (CWE-319) in TP-Link Tapo devices during Bluetooth communication in the initial setup phase. The affected models include Tapo L535E versions 1.0 and 3.0, P300 v1.0, and D100C v1.0 (a chime accessory for various Tapo cameras). Bluetooth communication during initialization is unencrypted, allowing attackers within Bluetooth range to sniff or perform man-in-the-middle attacks on setup data. This could lead to unauthorized control of the device during initialization. The vulnerability does not affect other communication phases or cloud services. No patch or official remediation level has been published by TP-Link as of the data provided.

An attacker within Bluetooth range can intercept or manipulate unencrypted Bluetooth setup communications, potentially gaining unauthorized control of the device during initialization. This could compromise device security at the setup stage but does not indicate ongoing operational compromise. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should limit physical proximity to the device during setup and ensure setup is performed in a secure environment to reduce the risk of Bluetooth interception. No official vendor mitigation or temporary fix has been provided.