The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version 1.1.22 Build 220725 is reused across all cameras. An attacker with physical access to a camera is able to extract and decrypt sensitive data containing the Wifi password and the TP-LINK account credential of the victim.
References
| Link | Resource |
|---|---|
| http://tapo.com | Product |
| http://tp-link.com | Product |
| https://www.claranet.fr/blog/dans-les-entrailles-dune-camera-connectee-tp-link-14 | Exploit Third Party Advisory |
| http://tapo.com | Product |
| http://tp-link.com | Product |
| https://www.claranet.fr/blog/dans-les-entrailles-dune-camera-connectee-tp-link-14 | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 07:52
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://tapo.com - Product | |
| References | () http://tp-link.com - Product | |
| References | () https://www.claranet.fr/blog/dans-les-entrailles-dune-camera-connectee-tp-link-14 - Exploit, Third Party Advisory |
12 Jun 2023, 16:28
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:tp-link:tapo_c200_firmware:1.2.2:build_220725:*:*:*:*:*:* cpe:2.3:h:tp-link:tapo_c200:3:*:*:*:*:*:*:* |
|
| CWE | CWE-522 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.6 |
| References | (MISC) https://www.claranet.fr/blog/dans-les-entrailles-dune-camera-connectee-tp-link-14 - Exploit, Third Party Advisory | |
| References | (MISC) http://tapo.com - Product | |
| References | (MISC) http://tp-link.com - Product | |
| First Time |
Tp-link
Tp-link tapo C200 Firmware Tp-link tapo C200 |
06 Jun 2023, 18:33
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-06 18:15
Updated : 2024-11-21 07:52
NVD link : CVE-2023-27126
Mitre link : CVE-2023-27126
CVE.ORG link : CVE-2023-27126
JSON object : View
Products Affected
tp-link
- tapo_c200_firmware
- tapo_c200
CWE
CWE-522
Insufficiently Protected Credentials