TP-Link Tapo C325WB: Predictable pre-shared key in local media streaming
Summary
The Tapo C325WB V2 camera generates the pre-shared key for its local media streaming service with a time-seeded pseudo-random number generator. The resulting key is predictable and can be recovered. An unauthenticated attacker on the adjacent network can use the recovered key to access live video and audio streams without valid credentials.
Affected
- Tapo C325WB V2 firmware before V2_1.3.3 Build 260914
- Default configuration is unaffected according to the CNA record
Fixed in
- V2_1.3.3 Build 260914 (US firmware release, published 2026-10-08)
- EU fixed build: Unknown.
Workaround
Unknown. No vendor workaround found. Update the firmware.
Exploitation
- No evidence of exploitation in the wild found (not verified against CISA KEV)
- No public proof-of-concept found
- EPSS about 0.27%
- CISA SSVC: exploitation none, automatable no, technical impact total
Our recommendation
- Update the Tapo C325WB V2 to V2_1.3.3 Build 260914 or later via the Tapo app, and check the EU download page for the current EU build
- Patch together with CVE-2026-105672 and CVE-2026-105673, which are covered by the same TP-Link advisory
- If a camera cannot be updated immediately, isolate it on a separate IoT VLAN without access to business systems
- Check which cameras are deployed and whether they are reachable from general office networks
- Priority: medium to high for SMEs with cameras on a flat network
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- TP-Link advisory www.tp-link.com
- TP-Link US download page www.tp-link.com
- TP-Link EN download page www.tp-link.com
- CVE record summary (threatint) cve.threatint.com
- VulnRichment (Vulners) vulners.com
- SecurityOnline securityonline.info
- Quest Review Center questreviewcenter.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:12.
Original description (NVD)
TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator, making the key predictable and recoverable. An unauthenticated attacker on the adjacent network can recover the key and authenticate to the media streaming service without valid user credentials. Successful exploitation may allow an unauthenticated adjacent-network attacker to access and take over live video and audio streams, compromising the confidentiality and integrity of camera media.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.