TP-Link Tapo C500 V1 Wi-Fi Camera RSA Private Key hard-coded key

Summaryinfo

A vulnerability classified as critical was found in TP-Link Tapo C500 V1 Wi-Fi Camera and Tapo C500 V2 Wi-Fi Camera. The affected element is an unknown function of the component RSA Private Key Handler. The manipulation results in hard-coded key. This vulnerability is reported as CVE-2025-1099. An attack on the physical device is feasible. No exploit exists.

Detailsinfo

A vulnerability classified as critical has been found in TP-Link Tapo C500 V1 Wi-Fi Camera and Tapo C500 V2 Wi-Fi Camera (version unknown). Affected is an unknown function of the component RSA Private Key Handler. The manipulation with an unknown input leads to a hard-coded key vulnerability. CWE is classifying the issue as CWE-321. The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The TP-Link Tapo C500 V1 and V2 are a pan-and-tilt outdoor Wi-Fi security cameras designed for comprehensive surveillance. This vulnerability exists in Tapo C500 Wi-Fi camera due to hard-coded RSA private key embedded within the device firmware. An attacker with physical access could exploit this vulnerability to obtain cryptographic private keys which can then be used to perform impersonation, data decryption and man in the middle attacks on the targeted device.

The weakness was disclosed by India as CIVN-2025-0017. The advisory is shared for download at cert-in.org.in. This vulnerability is traded as CVE-2025-1099 since 02/07/2025. The exploitability is told to be difficult. The attack needs to be approached locally. The exploitation doesn't require any form of authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.001.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• TP-Link

Name

• Tapo C500 V1 Wi-Fi Camera
• Tapo C500 V2 Wi-Fi Camera

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion