{"id":"CVE-2026-105815","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-105815","generatedAt":"2026-10-28T01:53:37.563Z","title":"TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests.","description":"TP-Link Tapo\nC210 V3.60 may expose shared credential material and cryptographic metadata\nthrough unauthenticated DS JSON API requests. The exposed shared credential can\nbe accepted by the Streamd Digest authentication mechanism as an administrative\npassword, allowing an unauthenticated adjacent-network attacker to establish\nencrypted media sessions without knowledge of the device account\npassword.  \n\n\n\n\n\n\n\n\n\nSuccessful\nexploitation may disclose credential and cryptographic material and allow\nunauthorized access to encrypted media sessions.","published":"2026-10-19T22:17:03.000Z","lastModified":"2026-10-20T20:17:13.000Z","status":"Deferred","sourceIdentifier":"f23511db-6c3e-4e32-a477-6aa17d310630","cvss":{"version":"4.0","score":7.1,"severity":"HIGH","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M"},"cwe":["CWE-287"],"affected":[],"epss":{"score":0.00238,"percentile":0.14776,"date":"2026-10-26","history":[{"date":"2026-10-20","score":0.00207,"percentile":0.10241}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.24%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-19T22:17:03.000Z","detail":{"score":"7.1","severity":"HIGH","publishedAt":"2026-10-19T22:17:03.153Z"},"summary":"New CVE, high severity (CVSS 7.1)."}],"references":[{"url":"https://www.tp-link.com/us/support/download/tapo-c210/#Firmware-Release-Notes","source":"f23511db-6c3e-4e32-a477-6aa17d310630"},{"url":"https://www.tp-link.com/us/support/faq/5352/","source":"f23511db-6c3e-4e32-a477-6aa17d310630"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-105815","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}