{"id":"CVE-2026-105815","kind":"vulnerability","aliases":["CVE-2026-105815"],"related":[],"title":"TP-Link Tapo C210: unauthenticated API leaks credential material, enabling camera access","description":"TP-Link Tapo\nC210 V3.60 may expose shared credential material and cryptographic metadata\nthrough unauthenticated DS JSON API requests. The exposed shared credential can\nbe accepted by the Streamd Digest authentication mechanism as an administrative\npassword, allowing an unauthenticated adjacent-network attacker to establish\nencrypted media sessions without knowledge of the device account\npassword.  \n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may disclose credential and cryptographic material and allow\nunauthorized access to encrypted media sessions.","summary":"The TP-Link Tapo C210 V3.60 camera exposes shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. An adjacent-network attacker can use that credential with the Streamd Digest authentication mechanism as an administrative password to open encrypted media sessions without the device account password.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cameras","home-network","infrastructure","iot","tapo-c210","tp-link"],"not_affected_if":["different-model-or-firmware","no-adjacent-network-access"],"how_to_check":"- Confirm the camera model and firmware: Tapo C210 running V3.60 is affected per the NVD entry\n- unknown for any other command or file check; the sources do not say how to probe the DS JSON API from the device side","fix":"- unknown; the sources do not name a fixed firmware version or vendor patch\n- Until a fix is confirmed, restrict the camera to a segregated network segment the attacker cannot reach","status":"open","published_at":"2026-10-19T22:17:03+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","triaged_at":"2026-10-25T03:34:51+00:00","updated_at":"2026-10-25T03:34:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T03:34:51Z","model":"claude-haiku-5-5","output":{"fix":"- unknown; the sources do not name a fixed firmware version or vendor patch\n- Until a fix is confirmed, restrict the camera to a segregated network segment the attacker cannot reach","reach":"network","title":"TP-Link Tapo C210: unauthenticated API leaks credential material, enabling camera access","impact":"high","summary":"The TP-Link Tapo C210 V3.60 camera exposes shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. An adjacent-network attacker can use that credential with the Streamd Digest authentication mechanism as an administrative password to open encrypted media sessions without the device account password.","category":"infrastructure","nicknames":[],"who_cares":["tp-link","tapo-c210","iot","home-network","cameras"],"confidence":0.6,"needs_auth":"no","worst_case":"Adjacent attacker gains admin-level access to live encrypted camera streams","analyst_note":"Find the vendor advisory or a fixed firmware version for Tapo C210 V3.60 and any check to see if the DS API is reachable; NVD alone gives no fix or check.","how_to_check":"- Confirm the camera model and firmware: Tapo C210 running V3.60 is affected per the NVD entry\n- unknown for any other command or file check; the sources do not say how to probe the DS JSON API from the device side","needs_analyst":true,"not_affected_if":["different-model-or-firmware","no-adjacent-network-access"],"who_is_affected":"Owners of Tapo C210 cameras on firmware V3.60 are affected, and the risk applies to anyone sharing the camera's local network segment. Exposure depends on the camera's unauthenticated DS JSON API being reachable from that network. Cameras on other models or firmware versions are not covered by this entry.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00067,"input_tokens":3399,"output_tokens":661,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-105815':16A,19A '-2026':15A,18A 'accept':108C 'access':13A,149C 'account':80B,136C 'adjac':55B,123C 'adjacent-network':54B,122C 'administr':70B,117C 'allow':119C,147C 'api':7A,51B,100C 'attack':57B,125C 'authent':66B,113C 'c210':5A,28B,37B,86C 'camera':12A,20B,39B 'credenti':9A,42B,61B,91C,105C,142C 'cryptograph':45B,94C,144C 'cve':14A,17A 'devic':79B,135C 'digest':65B,112C 'disclos':141C 'ds':49B,98C 'enabl':11A 'encrypt':74B,128C,151C 'establish':127C 'exploit':139C 'expos':40B,89C,103C 'home':22B 'home-network':21B 'infrastructur':24B 'iot':25B 'json':50B,99C 'knowledg':132C 'leak':8A 'link':3A,31B,35B,84C 'materi':10A,43B,92C,145C 'may':88C,140C 'mechan':67B,114C 'media':75B,129C,152C 'metadata':46B,95C 'network':23B,56B,124C 'open':73B 'password':71B,81B,118C,137C 'request':52B,101C 'session':76B,130C,153C 'share':41B,90C,104C 'streamd':64B,111C 'success':138C 'tapo':4A,27B,36B,85C 'tapo-c210':26B 'tp':2A,30B,34B,83C 'tp-link':1A,29B,33B,82C 'unauthent':6A,48B,97C,121C 'unauthor':148C 'use':59B 'v3.60':38B,87C 'without':77B,131C","nicknames":[],"mitigations":[],"who_affected":"Owners of Tapo C210 cameras on firmware V3.60 are affected, and the risk applies to anyone sharing the camera's local network segment. Exposure depends on the camera's unauthenticated DS JSON API being reachable from that network. Cameras on other models or firmware versions are not covered by this entry.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T22:17:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f23511db-6c3e-4e32-a477-6aa17d310630","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105815","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105815","severity":null,"published_at":"2026-10-19T22:17:03+00:00","modified_at":"2026-10-20T20:17:12+00:00","first_seen_at":"2026-10-23T21:57:19+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}