CVE-2026-105672 Overview
CVE-2026-105672 is an unauthenticated authorization bypass vulnerability affecting the TP-Link Tapo C325WB V2 wireless security camera. The flaw resides in the HTTPS JSON API dispatcher listening on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification and invoke privileged actions without authenticating. The weakness maps to [CWE-287] Improper Authentication.
Critical Impact
Successful exploitation allows an unauthenticated adjacent-network attacker to view live video and audio, modify device settings, and extract sensitive device information or secrets.
Affected Products
- TP-Link Tapo C325WB V2 (firmware versions prior to the vendor-published fix)
- Devices exposing the HTTPS JSON API dispatcher on TCP port 443
- Deployments where the camera is reachable from an adjacent wireless or LAN segment
Discovery Timeline
- 2026-10-08 - CVE-2026-105672 published to NVD
- 2026-10-15 - Last updated in NVD database
Technical Details for CVE-2026-105672
Vulnerability Analysis
The Tapo C325WB V2 exposes a JSON-based control API over HTTPS on TCP port 443. The dispatcher routes incoming requests to handler functions that perform camera configuration, streaming control, and account operations. Normally these handlers require a valid authenticated session before privileged operations execute.
The dispatcher contains a logic flaw in how it evaluates session state when a request body includes an onboarding-scoped object. Onboarding routines are designed to run during the initial device setup when no session yet exists. By embedding this object into any JSON request, an attacker causes the dispatcher to treat the request as part of the pre-authenticated onboarding flow and skip session verification.
Once verification is skipped, privileged handlers execute with full authority. This exposes live audio and video feeds, device configuration, and stored secrets to any attacker reachable on the adjacent network segment.
Root Cause
The root cause is improper authentication state resolution in the JSON API dispatcher. Session validation is conditional on the structure of the request body rather than enforced centrally. Trusting attacker-controlled fields to decide whether a request is pre-authenticated violates the principle of secure defaults.
Attack Vector
The attack vector is adjacent network. The attacker must reach the camera's HTTPS endpoint, which typically means joining the same Wi-Fi network or an upstream segment that can route to the device. No credentials, user interaction, or special privileges are required. The attacker sends a crafted JSON request to port 443 containing the onboarding-scoped field and immediately invokes privileged actions.
No verified public proof-of-concept code is available at this time. Technical details and the fixed firmware are published in the TP-Link Firmware Release Notes and TP-Link FAQ #5333.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-105672
Indicators of Compromise
- Unexpected HTTPS POST requests to TCP port 443 of Tapo C325WB V2 cameras that contain onboarding-related JSON fields outside the initial setup window.
- RTSP or media session establishment from unknown clients on the adjacent network segment.
- Configuration changes (account, streaming, or network settings) on the camera without a corresponding administrator action in the Tapo app.
Detection Strategies
- Inspect wireless and LAN segments for unauthorized hosts initiating HTTPS traffic to Tapo cameras outside the mobile app's expected source addresses.
- Baseline normal Tapo API call patterns and alert on JSON payloads that mix onboarding-scoped objects with privileged method invocations.
- Correlate camera firmware version telemetry against the vendor-published fixed build to identify unpatched devices.
Monitoring Recommendations
- Enable wireless intrusion detection on IoT VLANs and log all flows to and from camera IP addresses.
- Forward network metadata and DHCP logs to a central SIEM so new or anomalous clients on the camera segment are surfaced quickly.
- Review camera event logs through the Tapo cloud console on a routine basis for unexplained setting changes or stream access events.
How to Mitigate CVE-2026-105672
Immediate Actions Required
- Update the Tapo C325WB V2 to the latest firmware published by TP-Link that addresses CVE-2026-105672.
- Place IoT cameras on a dedicated, isolated VLAN with no routing to user or server networks.
- Restrict Wi-Fi access to the camera SSID using strong WPA2/WPA3 pre-shared keys and client isolation.
- Audit all Tapo accounts linked to the device and rotate credentials after patching.
Patch Information
TP-Link has published updated firmware for the Tapo C325WB V2 that corrects the dispatcher's session verification logic. Fixed builds and release notes are available in the TP-Link Firmware Release Notes (EN) and the TP-Link Firmware Release Notes (US). Additional vendor guidance is documented in TP-Link FAQ #5333.
Workarounds
- Isolate the camera on a network segment that is not reachable from guest Wi-Fi, untrusted clients, or BYOD devices until firmware is applied.
- Block inbound TCP port 443 to the camera from any host other than the designated Tapo mobile client or management workstation using firewall or access-point ACLs.
- Disable Wi-Fi auto-join and remove the camera SSID from devices that do not require local control, reducing the adjacent attack surface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
