---
id: CVE-2026-105815
title: >-
  Credential Material Exposure Leading to Unauthorized Streamed Media-Session
  Access in TP-Link Tapo C210
summary: >-
  TP-Link Tapo

  C210 V3.60 may expose shared credential material and cryptographic metadata

  through unauthenticated DS JSON API requests. The exposed shared credential
  can

  be accepted by the Streamd Digest authentication mechanism as an adm…
severity: high
cvss: 7.1
cvssVector: 'CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-287
vendor: TP-Link Systems Inc.
product: Tapo C210 v3.6
affected:
  - tapo_c210_v3.6 < V3.6_1.2.7 Build 260818
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T21:27:02.599Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-105815'
references:
  - url: >-
      https://www.tp-link.com/us/support/download/tapo-c210/#Firmware-Release-Notes
  - url: 'https://www.tp-link.com/us/support/faq/5352/'
tags:
  - cve.org
ingestedAt: '2026-10-19T21:43:56.117Z'
---

## Overview

TP-Link Tapo
C210 V3.60 may expose shared credential material and cryptographic metadata
through unauthenticated DS JSON API requests. The exposed shared credential can
be accepted by the Streamd Digest authentication mechanism as an administrative
password, allowing an unauthenticated adjacent-network attacker to establish
encrypted media sessions without knowledge of the device account
password.  









Successful
exploitation may disclose credential and cryptographic material and allow
unauthorized access to encrypted media sessions.

## Affected

- `tapo_c210_v3.6 < V3.6_1.2.7 Build 260818`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.