CVE-2026-105815: Tapo C210 v3.6 0 to before V3.6_1.2.7 Build 260818

Affected technology

Tapo C210 v3.6 · 0 to before V3.6_1.2.7 Build 260818
TP-Link Systems Inc.

Description’s affected range: through unauthenticated DS JSON API requests

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 4.0): Adjacent network · No privileges required · No user interaction required

What an attacker can do

An unauthenticated adjacent-network attacker can establish encrypted media sessions without knowledge of the device account password. Source advisory’s CVSS 4.0 assessment (base score 7.1/10) rates confidentiality impact as high; integrity and availability impact as none.