CVE-2026-105672
HIGH—CVSS v3
—CVSS v2
0.25%
EPSS (exploit probability)
CWE-287CWE
Description
TP-Link Tapo
C325WB V2 contains an unauthenticated authorization bypass vulnerability in the
HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network
can append an onboarding-scoped object to a JSON request to bypass session
verification and invoke privileged actions without authentication.
Successful
exploitation may allow an unauthenticated adjacent-network attacker to access
live video and audio, modify device settings, and obtain sensitive device
information or secrets.
Affected routers (0)
No routers currently mapped to this CVE in our database.