CVE-2026-102368CWE-312

CVE-2026-102368

published October 9, 2026

CVSS
5.4
EPSS
0%
Percentile
0.9
In the wild
Unconfirmed
What it is

Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physical access to an affected device can recover this sensitive material from the firmware.

Successful exploitation of this vulnerability may result in the disclosure of device-specific cryptographic material and could, under certain conditions, increase the risk of unauthorized access to related protected information or communications.

The record
Technical detail
CVSS
5.4 · NONE
CVSS v4.0
5.4 · CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00103 · 0.9th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2026-10-09T01:17Z
References (2)
EPSS history
Timeline
  • 10 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 08 OCT 20:54Z
    Plaintext Storage of a Device-Specific Private Key in Tapo S505 Firmware
    cvelistv5
  • 08 OCT 20:54Z
    Plaintext Storage of a Device-Specific Private Key in Tapo S505 Firmware
    cvelistv5