Attributed metadata history
Up to 100 retained publisher events per page for ea80fce9b6c0c5fa46aa4f36610949a44c35349d9c45893fb91a543c351a81b0. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_350d40f2cc69277bca
observed · 2026-10-12 08:34:02 UTC
available
Fingerprint: fe0fdc07a129ff203534388ab215df24d870069207d85287923a2a35a12b5578
intelligence_src_350d40f2cc69277bca
observed · 2026-10-12 08:34:02 UTC
An attacker sending a malformed HTTP POST request over LAN to a TP-Link Smart camera device can trigger the vulnerability described here. This report describes an authentication bypass vulnerability in the HTTP server implementation. The vulnerability we are disclosing in this advisory affected a wide range of TP-Link devices, including TAPO Smart Cameras. A TP-Link Security Advisory released was promised to be released in April 2026 after several delays, but this did not happen, without the vendor providing any explanation. Vulnerability Details The TAPO architecture can authenticate different account roles, one of them is the hub user. A whitelist introduced in recent builds (2025) limits this role to a few less sensitive actions.
Fingerprint: ccde21af55e9a5523cf5a954ab7f4353fdf16b81454f7a66c9948e70dd168dd7