MEDIUM 5.3 NVD
CVE-2026-105814
TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and pub
TP-Link Tapo
C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API.
A crafted JSON request containing both a protected operation and public
onboarding-related fields may cause module-level authorization checks to be
applied inconsistently, allowing protected camera operations, including
pan-tilt-zoom control, to be executed without a valid authenticated
session.
Successful
exploitation may allow an unauthenticated attacker on the adjacent network to
perform protected camera operations, including pan-tilt-zoom (PTZ) control,
without a valid authenticated session. This could result in unauthorized
manipulation of camera functionality.
References
- https://www.tp-link.com/us/support/download/tapo-c210/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/faq/5352/
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-10-19 via NVD.
vulnfeed aggregates 17400 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.