---
id: "CVE-2026-105815"
kind: "vulnerability"
aliases: ["CVE-2026-105815"]
title: "TP-Link Tapo C210: unauthenticated API leaks credential material, enabling camera access"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["cameras", "home-network", "infrastructure", "iot", "tapo-c210", "tp-link"]
not_affected_if: ["different-model-or-firmware", "no-adjacent-network-access"]
published_at: "2026-10-19T22:17:03+00:00"
first_seen_at: "2026-10-23T21:57:19+00:00"
updated_at: "2026-10-25T03:34:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105815", "first_seen_at": "2026-10-23T21:57:19+00:00"}]
---

# TP-Link Tapo C210: unauthenticated API leaks credential material, enabling camera access

The TP-Link Tapo C210 V3.60 camera exposes shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. An adjacent-network attacker can use that credential with the Streamd Digest authentication mechanism as an administrative password to open encrypted media sessions without the device account password.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the camera model and firmware: Tapo C210 running V3.60 is affected per the NVD entry
- unknown for any other command or file check; the sources do not say how to probe the DS JSON API from the device side

## Fix

- unknown; the sources do not name a fixed firmware version or vendor patch
- Until a fix is confirmed, restrict the camera to a segregated network segment the attacker cannot reach

## Timeline

- 2026-10-23T21:57:19+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105815

## From the sources

TP-Link Tapo
C210 V3.60 may expose shared credential material and cryptographic metadata
through unauthenticated DS JSON API requests. The exposed shared credential can
be accepted by the Streamd Digest authentication mechanism as an administrative
password, allowing an unauthenticated adjacent-network attacker to establish
encrypted media sessions without knowledge of the device account
password.  









Successful
exploitation may disclose credential and cryptographic material and allow
unauthorized access to encrypted media sessions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_