Live › vulnerability › CVE-2026-105815
Go to dashboardThe TP-Link Tapo C210 V3.60 camera exposes shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. An adjacent-network attacker can use that credential with the Streamd Digest authentication mechanism as an administrative password to open encrypted media sessions without the device account password.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Owners of Tapo C210 cameras on firmware V3.60 are affected, and the risk applies to anyone sharing the camera's local network segment. Exposure depends on the camera's unauthenticated DS JSON API being reachable from that network. Cameras on other models or firmware versions are not covered by this entry.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative password, allowing an unauthenticated adjacent-network attacker to establish encrypted media sessions without knowledge of the device account password.
Successful exploitation may disclose credential and cryptographic material and allow unauthorized access to encrypted media sessions.
This page as .md · .json · in your agent: get_signal("CVE-2026-105815")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.