Description (CNA)
TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera operations, including pan-tilt-zoom control, to be executed without a valid authenticated session. Successful exploitation may allow an unauthenticated attacker on the adjacent network to perform protected camera operations, including pan-tilt-zoom (PTZ) control, without a valid authenticated session. This could result in unauthorized manipulation of camera functionality.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| TP-Link Systems Inc. / Tapo C210 v3.6 | affected 0 before V3.6_1.2.7 Build 260818 |
CWE
CWE-287
References
- https://www.tp-link.com/us/support/download/tapo-c210/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/faq/5352/
ADP enrichment
No English description supplied.
No references supplied.