CVE-2026-105814: Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210
TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera operations, including pan-tilt-zoom control, to be executed without a valid authenticated session.
Successful exploitation may allow an unauthenticated attacker on the adjacent network to perform protected camera operations, including pan-tilt-zoom (PTZ) control, without a valid authenticated session. This could result in unauthorized manipulation of camera functionality.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated attacker on the adjacent network can exploit it. The attacker does not need a valid authenticated session.
What does an attacker need to send to trigger the authorization bypass?
The attack requires a crafted DS JSON API request that combines a protected operation with public onboarding-related fields. This can cause module-level authorization checks to be applied inconsistently.
What camera functions could be affected?
Protected camera operations may be executed without authentication, including pan-tilt-zoom control. This can allow unauthorized manipulation of camera functionality.