CVE-2025-1099CWE-321

Information Disclosure Vulnerability in TP-Link Tapo C500 Wi-Fi Camera

High · published February 10, 2025

CVSS v4.0
7.0
EPSS
0%
Percentile
16.8
In the wild
Unconfirmed
What it is

This vulnerability exists in Tapo C500 Wi-Fi camera due to hard-coded RSA private key embedded within the device firmware. An attacker with physical access could exploit this vulnerability to obtain cryptographic private keys which can then be used to perform impersonation, data decryption and man in the middle attacks on the targeted device.

The record
Technical detail
CVSS v4.0
7.0 · HIGH
Vector
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00260 · 16.8th percentile
Weakness
CWE-321 · Use of Hard-coded Cryptographic Key
Published
2025-02-10T10:44Z
EPSS history
Timeline
  • 10 FEB 10:44Z
    Information Disclosure Vulnerability in TP-Link Tapo C500 Wi-Fi Camera
    cvelistv5