5.4

CVE-2026-102368: tp-link system inc. tapo s505 v1.6

CVSS: 5.4v4.0MediumDeferred
Published 08-10-2026Last modified 09-10-2026
Open JSON

Vulnerability summary

CVE-2026-102368 is a medium (CVSS 5.4) vulnerability in tp-link system inc. tapo s505 v1.6. EPSS estimates a 0.10% chance of exploitation in the next 30 days, higher than 0.9% of scored vulnerabilities.

Overall risk
22/100
0100
Low · default modelHow is this calculated?
CVSS score
5.4/10
010
Medium · v4.0 (CVE.org)
EPSS score
0.10%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 08-10-2026
    PublishedVulnerability first disclosed.
  2. 09-10-2026
    Last modifiedVulnerability information updated.

Description

Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physical access to an affected device can recover this sensitive material from the firmware. Successful exploitation of this vulnerability may result in the disclosure of device-specific cryptographic material and could, under certain conditions, increase the risk of unauthorized access to related protected information or communications.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

0.10%

Chance of exploitation in the next 30 days

Percentile

1%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

09-10-202621-10-2026
EPSS score
0.10%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Tp-link system inc.1 product

1 vendor · 1 product

References

2 links