CVE-2026-105814 in Tapo C210
Summary
by MITRE • 10/20/2026
TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera operations, including pan-tilt-zoom control, to be executed without a valid authenticated session.
Successful exploitation may allow an unauthenticated attacker on the adjacent network to perform protected camera operations, including pan-tilt-zoom (PTZ) control, without a valid authenticated session. This could result in unauthorized manipulation of camera functionality.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The TP-Link Tapo C210 running firmware version 3.60 contains a critical authentication bypass vulnerability within its DS JSON API implementation. This flaw stems from an inconsistent application of module-level authorization checks when processing specific types of HTTP requests. Specifically, the vulnerability is triggered by crafted JSON payloads that simultaneously include fields associated with protected operations and public onboarding-related parameters. The underlying logic fails to properly isolate or validate these mixed inputs, leading to a state where the security controls intended for sensitive functions are effectively bypassed due to the presence of benign initialization data in the same request structure.
From a technical perspective, this issue represents a classic case of improper authorization control within an API endpoint. When the server processes the JSON object, it appears to prioritize or incorrectly evaluate the public onboarding fields over the protected operational commands contained within the same payload. Consequently, the authentication middleware does not enforce the required session validation for the sensitive actions requested by the attacker. This architectural flaw allows unauthenticated actors to interact with internal device functions that are strictly meant to be accessible only after successful user authentication and session establishment.
The operational impact of this vulnerability is significant for users relying on the Tapo C210 for home security or monitoring purposes. An adversary positioned on an adjacent network segment, such as a local Wi-Fi network, can exploit this flaw without needing valid credentials. By sending specially constructed HTTP requests to the device's API endpoint, the attacker gains the ability to execute protected camera operations. Most notably, this includes full control over the pan-tilt-zoom (PTZ) mechanisms of the camera. This capability allows an unauthorized individual to manipulate the field of view, potentially tracking specific individuals or areas without detection through traditional login failure logs, as no authentication attempt is technically made for these actions.
This vulnerability aligns with CWE-287, which describes Improper Authentication, and more specifically relates to authorization flaws often categorized under CWE-862 Missing Authorization. In the context of the MITRE ATT&CK framework, this exploitation technique corresponds to T1098.004 SSH Unauthorized Access or similar API abuse tactics where an attacker leverages misconfigured access controls to gain unauthorized entry into a system component. The ability to control PTZ functions remotely elevates the risk from mere data exposure to active physical surveillance manipulation, compromising both privacy and security integrity.
To mitigate this risk, users of the TP-Link Tapo C210 should immediately update their device firmware to the latest version released by the manufacturer, which addresses these authorization logic errors in the DS JSON API. Until an official patch is applied or available, network segmentation strategies can provide a partial defense-in-depth measure. Placing IoT devices on isolated VLANs separate from general user workstations and critical infrastructure reduces the attack surface for adjacent network attackers. Additionally, disabling remote management features if not strictly necessary limits exposure to external threats, although this specific vulnerability primarily affects local network access due to its reliance on adjacency.