Predictable Media Stream Pre-Shared Key Vulnerability in TP-Link Tapo C325WB
TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number generator, making the key predictable and recoverable. An unauthenticated attacker on the adjacent network can recover the key and authenticate to the media streaming service without valid user credentials. Successful exploitation may allow an unauthenticated adjacent-network attacker to access and take over live video and audio streams, compromising the confidentiality and integrity of camera media.
CVE-2026-105674
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-105674
Tapo C325WB v2
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "TP-Link Systems Inc.",
"product": "Tapo C325WB v2",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V2_1.3.3 Build 260914",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-105674
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #29004 · Revision 1
- Added to Heist Feed
- Publisher date