Plaintext Storage of a Device-Specific Private Key in Tapo S505 Firmware
Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physical access to an affected device can recover this sensitive material from the firmware. Successful exploitation of this vulnerability may result in the disclosure of device-specific cryptographic material and could, under certain conditions, increase the risk of unauthorized access to related protected information or communications.
CVE-2026-102368
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-102368
Tapo S505 v1.6
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "TP-Link System Inc.",
"product": "Tapo S505 v1.6",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.4.1 Build 260713",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-102368
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #16216 · Revision 1
- Added to Heist Feed
- Publisher date