CVE-2026-105814: tp-link systems inc. tapo c210 v3.6 Improper Authentication

Vulnerability summary

CVE-2026-105814 is a medium (CVSS 5.3) Improper Authentication vulnerability in tp-link systems inc. tapo c210 v3.6. EPSS estimates a 0.23% chance of exploitation in the next 30 days, higher than 12.7% of scored vulnerabilities.

Timeline

1. 19-10-2026
   PublishedVulnerability first disclosed.
2. 20-10-2026
   Last modifiedVulnerability information updated.

Description

TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera operations, including pan-tilt-zoom control, to be executed without a valid authenticated session. Successful exploitation may allow an unauthenticated attacker on the adjacent network to perform protected camera operations, including pan-tilt-zoom (PTZ) control, without a valid authenticated session. This could result in unauthorized manipulation of camera functionality.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.