TP Link Systems Inc. Tapo C325Wb V2 vulnerabilities

3 vulnerabilities

Known vulnerabilities in TP Link Systems Inc. Tapo C325Wb V2, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.1HighCVE-2026-105673tp-link systems inc. · tapo c325wb v2Unauthenticated RTSP Tunnel Denial-of-Service Vulnerability in TP-Link Tapo C325WBAn unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Account feature is enabled. A crafted pair of RTSP-over-HTTP tunneling requests can cause memory corruption and crash the streaming daemon.  Successful exploitation may allow an unauthenticated adjacent-network attacker to disrupt live video and related streaming functions until the affected service recovers or restarts.EPSS0.20%8.7HighCVE-2026-105672tp-link systems inc. · tapo c325wb v2Unauthenticated JSON API Authorization Bypass Vulnerability in TP-Link Tapo C325WBTP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification and invoke privileged actions without authentication.  Successful exploitation may allow an unauthenticated adjacent-network attacker to access live video and audio, modify device settings, and obtain sensitive device information or secrets.EPSS0.24%8.7HighCVE-2026-105674tp-link systems inc. · tapo c325wb v2Predictable Media Stream Pre-Shared Key Vulnerability in TP-Link Tapo C325WBTP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator, making the key predictable and recoverable. An unauthenticated attacker on the adjacent network can recover the key and authenticate to the media streaming service without valid user credentials.  Successful exploitation may allow an unauthenticated adjacent-network attacker to access and take over live video and audio streams, compromising the confidentiality and integrity of camera media.EPSS0.20%