CVE-2023-35717CWE-640

TP-Link Tapo C210 Password Recovery Authentication Bypass Vulnerability

High · published May 3, 2024

CVSS v3.0
8.8
EPSS
1%
Percentile
49.0
In the wild
Unconfirmed
What it is

TP-Link Tapo C210 Password Recovery Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of TP-Link Tapo C210 IP cameras. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the password recovery mechanism. The issue results from reliance upon the secrecy of the password derivation algorithm when generating a recovery password. An attacker can leverage this vulnerability to bypass authentication on the system.

. Was ZDI-CAN-20484.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00620 · 49.0th percentile
Weakness
CWE-640 · Weak Password Recovery Mechanism for Forgotten Password
Published
2024-05-03T01:57Z
EPSS history
Timeline
  • 03 MAY 01:57Z
    TP-Link Tapo C210 Password Recovery Authentication Bypass Vulnerability
    cvelistv5