CVE-2026-105674
HIGH
8,7
Source: f23511db-6c3e-4e32-a477-6aa17d310630
Attack Vector: adjacent
Attack Complexity: low
Privileges Required: none
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
Description
AI Translation Available
TP-Link Tapo
C325WB V2 generates the pre-shared key used by its local media streaming
service with a time-seeded pseudo-random number generator, making the key
predictable and recoverable. An unauthenticated attacker on the adjacent
network can recover the key and authenticate to the media streaming service
without valid user credentials.
Successful
exploitation may allow an unauthenticated adjacent-network attacker to access
and take over live video and audio streams, compromising the confidentiality
and integrity of camera media.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,0020
Percentile
0,1th
Updated
EPSS Score Trend (Last 3 Days)
330
Use of Insufficiently Random Values
StableCommon Consequences
Security Scopes Affected:
Confidentiality
Other
Access Control
Potential Impacts:
Other
Bypass Protection Mechanism
Gain Privileges Or Assume Identity
Applicable Platforms
All platforms may be affected
https://www.tp-link.com/en/support/download/tapo-c325wb/#Firmware-Release-Notes
https://www.tp-link.com/us/support/download/tapo-c325wb/#Firmware-Release-Notes
https://www.tp-link.com/us/support/faq/5333/