CVE-2026-102368: Plaintext Storage of a Device-Specific Private Key in Tapo S505 Firmware
Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physical access to an affected device can recover this sensitive material from the firmware.
Successful exploitation of this vulnerability may result in the disclosure of device-specific cryptographic material and could, under certain conditions, increase the risk of unauthorized access to related protected information or communications.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Exposure is limited to affected TP-Link Tapo S505 devices where an attacker can obtain physical access to the device or its firmware storage. The provided information does not establish a remote-only attack path.
What must an attacker do to recover the sensitive material?
The attacker needs physical access to an affected device and must recover the device-specific cryptographic material from its firmware or nonvolatile storage. The material is stored in plaintext.
How can I determine whether a device may be affected?
Verify that the device is a TP-Link Tapo S505 and review the vendor's firmware release notes and support guidance referenced for the device. The provided information does not identify specific affected or fixed firmware versions.