{"id":"CVE-2026-105814","published":"2026-10-19T22:17:03.027","lastModified":"2026-10-19T22:17:03.027","description":"TP-Link Tapo\nC210 V3.60 contains an authentication bypass vulnerability in the DS JSON API.\nA crafted JSON request containing both a protected operation and public\nonboarding-related fields may cause module-level authorization checks to be\napplied inconsistently, allowing protected camera operations, including\npan-tilt-zoom control, to be executed without a valid authenticated\nsession. \n\n\n\n\n\nSuccessful\nexploitation may allow an unauthenticated attacker on the adjacent network to\nperform protected camera operations, including pan-tilt-zoom (PTZ) control,\nwithout a valid authenticated session. This could result in unauthorized\nmanipulation of camera functionality.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://www.tp-link.com/us/support/download/tapo-c210/#Firmware-Release-Notes","tags":[]},{"url":"https://www.tp-link.com/us/support/faq/5352/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}