Threat database

CVE-2026-100420 is a medium severity vulnerability in TP-Link Deco BE63 V2.0 that allows authenticated attackers to retrieve plaintext TP-Link ID account passwords via the cloud-client daemon. This exposure of sensitive information could enable attackers to compromise the associated cloud account and perform unauthorized actions. The vulnerability is identified as CWE-202 (Exposure of Sensitive Information Through Data Queries). No patch or remediation information is currently provided.

CVE-2026-89052 is a vulnerability in the TP-Link Archer C6 V2 router involving the use of a hardcoded cryptographic key shared universally across devices. This flaw allows an attacker who obtains an encrypted configuration file or protected credential data to recover plaintext credentials, potentially exposing sensitive administrative information. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.9. No patch or remediation information is currently provided by the vendor.

TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative password, allowing an unauthenticated adjacent-network attacker to establish encrypted media sessions without knowledge of the device account password.  Successful exploitation may disclose credential and cryptographic material and allow unauthorized access to encrypted media sessions.

TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera operations, including pan-tilt-zoom control, to be executed without a valid authenticated session.  Successful exploitation may allow an unauthenticated attacker on the adjacent network to perform protected camera operations, including pan-tilt-zoom (PTZ) control, without a valid authenticated session. This could result in unauthorized manipulation of camera functionality.

Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path. An authenticated attacker on the adjacent network can submit a crafted request containing an oversized encrypted password field, overwrite stack state, and execute commands with root privileges. Successful exploitation may allow an authenticated adjacent-network attacker to take control of the affected camera, modify camera behavior, access sensitive local configuration, and disrupt device availability.

CVE-2026-107795 is a high-severity vulnerability in TP-Link Omada Software Controller versions prior to 6.3.0.45. It involves missing authorization checks in the MSP and OpenAPI certificate/private-key management APIs, allowing authenticated users with low privileges to perform privileged certificate management operations. Exploitation could enable such users to upload or delete TLS certificates or private keys, potentially disrupting secure management access.

CVE-2026-102298 is a high-severity authorization bypass vulnerability in TP-Link Omada Software Controller (Windows) versions prior to 6.3.0.45. In MSP mode, the user-confirmation endpoint does not properly enforce permission checks, allowing authenticated users to supply a manipulated identifier parameter. This flaw enables user enumeration, credential verification, and unauthorized access to MSP resources or targeted accounts.

CVE-2026-109506 is an improper authentication vulnerability in TP-Link Systems Inc. RE190 v5 Wi-Fi range extenders. The devices use a custom reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture legitimate administrator login traffic may derive alternative credentials to gain administrator access. Exploitation requires the login to use HTTP and the attacker to observe session key, dictionary, and login values. Successful exploitation allows modification of device configuration settings.

CVE-2026-108473 is a high-severity vulnerability in TP-Link Systems Inc. HS103 v5 devices involving missing authentication for critical functions in the local device-management protocol. An unauthenticated attacker on an adjacent network can send management commands without proper authentication, potentially modifying device state or settings. Additionally, under certain conditions involving user, mobile app, and cloud interactions, account-related information may be exposed, risking cloud account compromise.

TP-Link Tapo C325WB v2 cameras use a time-seeded pseudo-random number generator to create the pre-shared key for their local media streaming service. This method produces predictable keys that an unauthenticated attacker on the adjacent network can recover. Exploiting this vulnerability allows unauthorized access to live video and audio streams, compromising their confidentiality and integrity.

TP-Link Tapo C325WB v2 has an unauthenticated authorization bypass vulnerability in its HTTPS JSON API on TCP port 443. An attacker on the adjacent network can exploit this flaw by appending an onboarding-scoped object to a JSON request, bypassing session verification and performing privileged actions without authentication. This can lead to unauthorized access to live video and audio streams, modification of device settings, and exposure of sensitive device information or secrets.

An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Account feature is enabled. A crafted pair of RTSP-over-HTTP tunneling requests can cause memory corruption and crash the streaming daemon.  Successful exploitation may allow an unauthenticated adjacent-network attacker to disrupt live video and related streaming functions until the affected service recovers or restarts.

The TP-Link Tapo S505 device firmware version 1.6 stores device-specific cryptographic material in plaintext within nonvolatile storage. This cleartext storage allows an attacker with physical access to the device to extract sensitive cryptographic information. Exploitation could lead to disclosure of this material and potentially increase the risk of unauthorized access to protected information or communications related to the device.

TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive number of preset-related elements, causing writes beyond the bounds of fixed-size stack arrays and resulting in a crash of the affected service. Successful exploitation may allow an authenticated attacker to cause the affected service to crash, resulting in a denial-of-service condition. Repeated exploitation may repeatedly disrupt camera management and PTZ-related functionality until the service recovers or restarts.

TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in a denial-of-service condition. Successful exploitation may allow an unauthenticated attacker with network access to the affected UDP service to repeatedly crash the TDP daemon, disrupting normal device operation and availability. No authentication, session establishment, or pairing is required to trigger the condition.

The TP-Link Kasa EC70 V4 and EC71 V4 devices have an improper access control vulnerability in their on-chip debug and test interface. The production debug interface is not logically disabled at the firmware or chip level, and the bootloader is not locked. Although the debug traces are physically severed during manufacturing, an attacker with physical access can restore the connection, interrupt the boot process, and manipulate boot parameters to gain an unauthenticated root shell during startup. This allows root-level command access, compromising the device's confidentiality, integrity, and availability. Exploitation requires physical device disassembly and manipulation of hardware and boot processes.

CVE-2026-84682 is a command injection vulnerability in the TDDPv2 service on TP-Link Archer AX90 v1 devices. An unauthenticated attacker on an adjacent network can exploit the setProductVer command handler to execute arbitrary OS commands as root during device boot. This leads to full device compromise with root privileges.

A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request data length before it is copied into a fixed-size stack buffer in the subtype 0x91 handler. Successful exploitation may allow an adjacent, unauthenticated attacker to cause a denial of service or achieve arbitrary code execution during the device setup phase through crafted TDDP packets.

Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service that becomes accessible after a reboot, and submit crafted input to execute arbitrary commands within the device management process. Successful exploitation may allow arbitrary command execution on the camera and compromise the confidentiality, integrity, and availability of the affected device. Exploitation requires access from the same local network, replay of the login challenge data, activation of the privileged service, and a device reboot.

Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup.  An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection to a different network. Successful exploitation disconnects the camera from its intended wireless network, making it unreachable on its management address, resulting in a denial-of-service condition.