{"id":"CVE-2026-105814","kind":"vulnerability","aliases":["CVE-2026-105814"],"related":[],"title":"TP-Link Tapo C210: authentication bypass lets attackers control camera without login","description":"TP-Link Tapo\nC210 V3.60 contains an authentication bypass vulnerability in the DS JSON API.\nA crafted JSON request containing both a protected operation and public\nonboarding-related fields may cause module-level authorization checks to be\napplied inconsistently, allowing protected camera operations, including\npan-tilt-zoom control, to be executed without a valid authenticated\nsession. \n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated attacker on the adjacent network to\nperform protected camera operations, including pan-tilt-zoom (PTZ) control,\nwithout a valid authenticated session. This could result in unauthorized\nmanipulation of camera functionality.","summary":"A crafted JSON request to the Tapo C210 V3.60 DS JSON API can mix a protected camera operation with public onboarding fields, so the authorization check is skipped. An attacker on the adjacent network can run protected operations, including pan-tilt-zoom control, without a valid session.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["home-network","infrastructure","iot","tapo-c210"],"not_affected_if":["different-firmware","different-model","isolated-network"],"how_to_check":"- Check the firmware version in the Tapo app under device settings or on the camera's web interface; unknown whether a fixed version exists in the sources.\n- Confirm whether the camera is reachable from networks other than the one it is on.","fix":"- Update the Tapo C210 firmware to a release later than `V3.60`; the sources do not name a fixed version.\n- Isolate the camera on its own VLAN until the update is applied.","status":"open","published_at":"2026-10-19T22:17:03+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T04:24:59+00:00","updated_at":"2026-10-25T04:24:59+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:24:58Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Tapo C210 firmware to a release later than `V3.60`; the sources do not name a fixed version.\n- Isolate the camera on its own VLAN until the update is applied.","reach":"network","title":"TP-Link Tapo C210: authentication bypass lets attackers control camera without login","impact":"medium","summary":"A crafted JSON request to the Tapo C210 V3.60 DS JSON API can mix a protected camera operation with public onboarding fields, so the authorization check is skipped. An attacker on the adjacent network can run protected operations, including pan-tilt-zoom control, without a valid session.","category":"infrastructure","nicknames":[],"who_cares":["tapo-c210","iot","home-network"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker controls camera pan-tilt-zoom and other protected operations without login.","analyst_note":"Find TP-Link's advisory and the fixed firmware version for Tapo C210 V3.60; the NVD entry alone gives no fix or check steps.","how_to_check":"- Check the firmware version in the Tapo app under device settings or on the camera's web interface; unknown whether a fixed version exists in the sources.\n- Confirm whether the camera is reachable from networks other than the one it is on.","needs_analyst":true,"not_affected_if":["different-model","different-firmware","isolated-network"],"who_is_affected":"Owners of TP-Link Tapo C210 cameras running firmware V3.60 are exposed, as the flaw is in the camera's DS JSON API. Exposure requires an attacker on the same adjacent network segment as the camera. Systems that do not run this model or firmware can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000655,"input_tokens":3441,"output_tokens":621,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105814':16A,19A '-2026':15A,18A 'adjac':60B,145C 'allow':118C,139C 'api':39B,91C 'appli':116C 'attack':9A,57B,142C 'authent':6A,84C,134C,162C 'author':52B,112C 'bypass':7A,85C 'c210':5A,27B,35B,80C 'camera':11A,44B,120C,150C,171C 'caus':108C 'check':53B,113C 'contain':82C,96C 'control':10A,71B,127C,158C 'could':165C 'craft':29B,93C 'cve':14A,17A 'ds':37B,89C 'execut':130C 'exploit':137C 'field':49B,106C 'function':172C 'home':21B 'home-network':20B 'includ':66B,122C,152C 'inconsist':117C 'infrastructur':23B 'iot':24B 'json':30B,38B,90C,94C 'let':8A 'level':111C 'link':3A,78C 'login':13A 'manipul':169C 'may':107C,138C 'mix':41B 'modul':110C 'module-level':109C 'network':22B,61B,146C 'onboard':48B,104C 'onboarding-rel':103C 'oper':45B,65B,100C,121C,151C 'pan':68B,124C,154C 'pan-tilt-zoom':67B,123C,153C 'perform':148C 'protect':43B,64B,99C,119C,149C 'ptz':157C 'public':47B,102C 'relat':105C 'request':31B,95C 'result':166C 'run':63B 'session':75B,135C,163C 'skip':55B 'success':136C 'tapo':4A,26B,34B,79C 'tapo-c210':25B 'tilt':69B,125C,155C 'tp':2A,77C 'tp-link':1A,76C 'unauthent':141C 'unauthor':168C 'v3.60':36B,81C 'valid':74B,133C,161C 'vulner':86C 'without':12A,72B,131C,159C 'zoom':70B,126C,156C","nicknames":[],"mitigations":[],"who_affected":"Owners of TP-Link Tapo C210 cameras running firmware V3.60 are exposed, as the flaw is in the camera's DS JSON API. Exposure requires an attacker on the same adjacent network segment as the camera. Systems that do not run this model or firmware can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T22:17:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f23511db-6c3e-4e32-a477-6aa17d310630","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105814","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105814","severity":null,"published_at":"2026-10-19T22:17:03+00:00","modified_at":"2026-10-20T20:17:12+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}