CVE-2026-105674: TP-Link Tapo C325WB Auth Bypass Vulnerability

CVE-2026-105674 Overview

CVE-2026-105674 affects the TP-Link Tapo C325WB V2 security camera. The device generates the pre-shared key (PSK) for its local media streaming service using a time-seeded pseudo-random number generator. An attacker on the adjacent network can predict the PSK and authenticate to the media streaming service without valid user credentials. Successful exploitation grants access to live video and audio streams. The vulnerability is tracked under CWE-330: Use of Insufficiently Random Values.

Critical Impact
Unauthenticated adjacent-network attackers can recover the media streaming PSK and take over live video and audio streams from the Tapo C325WB V2 camera.

Affected Products

TP-Link Tapo C325WB V2 (vulnerable firmware versions prior to the fixed release)
Local media streaming service component on the device
Deployments where the camera is reachable from an attacker-controlled adjacent network segment

Discovery Timeline

2026-10-08 - CVE-2026-105674 published to the National Vulnerability Database
2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-105674

Vulnerability Analysis

The Tapo C325WB V2 exposes a local media streaming service protected by a pre-shared key. The firmware derives this PSK from a pseudo-random number generator seeded with a predictable time-based value. Because the seed is drawn from a narrow, guessable range, an attacker can enumerate candidate seeds and reproduce the exact key the device generated.

Once the attacker reproduces the PSK, authentication to the streaming endpoint succeeds without any legitimate user credential or device-level trust relationship. The attacker then interacts with the service as if they held authorized access to the live media feed.

The flaw is a cryptographic weakness classified under CWE-330. It belongs to the broader category of Insecure Random Number Generation vulnerabilities. The impact is loss of confidentiality and integrity for camera media streams, including live video and audio.

Root Cause

The PSK generation routine seeds its PRNG with a time-derived value, such as a Unix timestamp from device boot or key provisioning. Attackers with knowledge of the approximate time window can brute-force the seed space and regenerate every possible key the device could have produced.

Attack Vector

An attacker on the same adjacent network (for example, the local Wi-Fi segment or an uplinked LAN) enumerates candidate seeds, derives the corresponding PSK values, and attempts authentication against the camera's local media streaming service. No user interaction and no prior credentials are required. The attacker needs only network reachability to the camera.

No verified public exploit code is available at this time. For technical details, consult the TP-Link FAQ on Tapo C325WB and the TP-Link Firmware Release Notes.

Detection Methods for CVE-2026-105674

Indicators of Compromise

Unexpected successful authentication events against the camera's local media streaming service from hosts that are not the paired Tapo client or hub.
Concurrent streaming sessions from multiple source IP addresses on the same camera.
Repeated authentication attempts to the streaming service from a single adjacent-network host, indicating seed enumeration.

Detection Strategies

Monitor DHCP and ARP tables on the camera's VLAN for unknown devices that initiate connections to Tapo camera ports.
Capture and inspect traffic to the local streaming service for authentication handshakes originating outside the Tapo mobile app or hub.
Alert on anomalous outbound bandwidth from the camera, which may indicate an unauthorized stream pull.

Monitoring Recommendations

Baseline normal client IPs that connect to the camera's streaming service and alert on deviations.
Forward network flow logs from the IoT segment to a central logging platform for correlation.
Enable intrusion detection on the IoT VLAN to flag repeated short-lived TCP sessions to camera ports.

How to Mitigate CVE-2026-105674

Immediate Actions Required

Update affected Tapo C325WB V2 cameras to the fixed firmware version published by TP-Link as soon as it is deployed to your region's release channel.
Place IP cameras on an isolated VLAN with no reachability from guest, user, or untrusted network segments.
Restrict inbound access to the camera's local streaming service to known management hosts using firewall or switch ACLs.

Patch Information

TP-Link addresses the issue in updated firmware for the Tapo C325WB V2. Review the TP-Link Firmware Release Notes and apply the latest available firmware. Confirm post-update that the device re-provisions its PSK using the corrected key-generation routine.

Workarounds

Isolate the camera on a dedicated SSID or VLAN that denies peer-to-peer client communication, limiting the adjacent-network attack surface.
Disable local streaming features where not required and rely on cloud-mediated access through the Tapo application.
Monitor the IoT network segment for unauthorized hosts and remove them before they can enumerate PSK seed values.

bash

# Example: restrict access to the camera streaming service using iptables on a Linux-based gateway
# Allow only the trusted management host to reach the camera's streaming ports
iptables -A FORWARD -s 192.0.2.10 -d 192.0.2.50 -p tcp --dport 8800 -j ACCEPT
iptables -A FORWARD -d 192.0.2.50 -p tcp --dport 8800 -j DROP