{"schemaVersion":3,"id":"CVE-2026-105815","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"TP-Link Tapo\nC210 V3.60 may expose shared credential material and cryptographic metadata\nthrough unauthenticated DS JSON API requests. The exposed shared credential can\nbe accepted by the Streamd Digest authentication mechanism as an administrative\npassword, allowing an unauthenticated adjacent-network attacker to establish\nencrypted media sessions without knowledge of the device account\npassword.\n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may disclose credential and cryptographic material and allow\nunauthorized access to encrypted media sessions.","dates":{"published":"2026-10-19T21:27:02.599Z","modified":"2026-10-20T19:22:38.887Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.1,"severity":"high","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":7.1,"severity":"high","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":7.1,"severity":"high","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00207,"percentile":0.10288,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-20T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00207,"percentile":0.10288}],"last30":[{"date":"2026-10-20T00:00:00.000Z","score":0.00207,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.00207,"percentile":0.10288}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-287","name":"Improper Authentication","description":"When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/287.html"}],"affected":[{"vendor":"tp-link systems inc.","product":"tapo c210 v3.6","name":"Tapo C210 v3.6","label":"tapo c210 v3.6","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< V3.6_1.2.7 Build 260818","noFixRecorded":false,"fixedIn":null}],"versionsText":"< V3.6_1.2.7 Build 260818","eol":null,"hubHref":"/vendor/tp-link_systems_inc/tapo_c210_v36"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.tp-link.com/us/support/download/tapo-c210/#Firmware-Release-Notes","label":"www.tp-link.com/us/support/download/tapo-c210/","hostname":"www.tp-link.com","tags":["Patch"]},{"url":"https://www.tp-link.com/us/support/faq/5352/","label":"www.tp-link.com/us/support/faq/5352/","hostname":"www.tp-link.com","tags":["Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-19T21:27:02.599Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-20T19:22:38.887Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":28,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T11:45:33.309Z","stale":false,"partial":false}}