CVE-2026-105815

TP-Link Tapo

C210 V3.60 may expose shared credential material and cryptographic metadata

through unauthenticated DS JSON API requests. The exposed shared credential can

be accepted by the Streamd Digest authentication mechanism as an administrative

password, allowing an unauthenticated adjacent-network attacker to establish

encrypted media sessions without knowledge of the device account

password.

Successful

exploitation may disclose credential and cryptographic material and allow

unauthorized access to encrypted media sessions.