TP-Link Tapo C325WB V2: Authorization bypass in JSON API
Summary
The HTTPS JSON API on TCP port 443 of the Tapo C325WB V2 outdoor camera does not properly verify sessions. An attacker on the same network can append an onboarding-scoped object to a JSON request and invoke privileged actions without logging in. Successful exploitation may allow access to live video and audio, changes to device settings, and disclosure of sensitive device information or secrets.
Affected
- Tapo C325WB V2 firmware before V2_1.3.3 Build 260914 (according to the CVE record; the vendor's own affected-version table could not be verified)
- Default configuration is listed as unaffected in the CVE record
Fixed in
- US: Tapo C325WB(US)_V2.6_1.3.3 Build 260914 (published 2026-10-08). The release note does not name the CVE.
- EU and other regions: Unknown. The newest EU/UK build found is V2_1.3.2 Build 260604, which predates the fix.
Workaround
- Unknown. The vendor refers to documented workarounds, but their content could not be retrieved.
- Isolate the camera on a separate IoT network segment.
- Block camera access from workstations and servers.
- Confirm that no port forwarding or remote access exposes the camera.
Exploitation
- No evidence of in-the-wild exploitation found.
- No public proof-of-concept found.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS about 0.25% to 0.34% (low).
- A vulnerability database describes remote code execution, which is not supported by the vendor advisory and remains unverified.
Our recommendation
- Check whether the camera firmware is V2_1.3.3 Build 260914 or later; update via the TP-Link regional download page.
- If no fixed build is available for your region, isolate the camera on a separate IoT VLAN and restrict access to it.
- Make sure the camera is not reachable from the internet through port forwarding or remote access.
- Monitor the network for unusual HTTPS traffic to the camera.
- Note that CVE-2026-105673 (RTSP denial of service) is listed in the same advisory; update to the same firmware.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- TP-Link Tapo C325WB download (EN) www.tp-link.com
- TP-Link Tapo C325WB download (US) www.tp-link.com
- TP-Link FAQ 5333 www.tp-link.com
- VulnCheck/Vulnrichment record vulners.com
- Strix CVE record www.strix.ai
- VulDB CVE-2026-105672 vuldb.com
- ThreatIntel CVE mirror cve.threatint.com
- TP-Link Nordic download page www.tp-link.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:12.
Original description (NVD)
TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification and invoke privileged actions without authentication. Successful exploitation may allow an unauthenticated adjacent-network attacker to access live video and audio, modify device settings, and obtain sensitive device information or secrets.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.