CVE-2026-105815: falha de alta gravidade em TP-Link Systems Inc. Tapo C210 v3.6
Credential Material Exposure Leading to Unauthorized Streamed Media-Session Access in TP-Link Tapo C210
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.2%
TP-Link Tapo
C210 V3.60 may expose shared credential material and cryptographic metadata
through unauthenticated DS JSON API requests. The exposed shared credential can
be accepted by the Streamd Digest authentication mechanism as an administrative
password, allowing an unauthenticated adjacent-network attacker to establish
encrypted media sessions without knowledge of the device account
password.
Successful
exploitation may disclose credential and cryptographic material and allow
unauthorized access to encrypted media sessions.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
TP-Link Systems Inc. · Tapo C210 v3.6CVEs relacionadas — TP-Link Systems Inc. Tapo C210 v3.6
No mesmo produto, das mais perigosas para as menos.