CVE-2026-105672

Unauthenticated JSON API Authorization Bypass Vulnerability in TP-Link Tapo C325WB

Assigner: TPLink
Reserved: 05.10.2026 Published: 08.10.2026 Updated: 08.10.2026

TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An attacker on the adjacent network can append an onboarding-scoped object to a JSON request to bypass session verification and invoke privileged actions without authentication.

Successful exploitation may allow an unauthenticated adjacent-network attacker to access live video and audio, modify device settings, and obtain sensitive device information or secrets.

Metrics

CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS Score: 8.7

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Adjacent	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	High	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	TP-Link Systems Inc.
Product	Tapo C325WB v2
Versions	Default: unaffected affected from 0 to V2_1.3.3 Build 260914 (excl.)

Vendor

TP-Link Systems Inc.

Product

Tapo C325WB v2

Versions

Default: unaffected

affected from 0 to V2_1.3.3 Build 260914 (excl.)

Credits

Andrey Charikov, Check Point Research finder

References

Problem Types

CWE-287 Improper Authentication CWE

Impacts

CAPEC-115 Authentication Bypass