CVE-2026-105673 TP-Link Systems Inc. CVE debrief

Who should care

Defenders responsible for TP-Link Tapo C325WB v2 devices, particularly those with the Camera Account feature enabled, should assess exposure and potential disruptions to live video and streaming functions.

Why it matters

Defenders should prioritize verifying exposure of Tapo C325WB v2 devices with the Camera Account feature enabled and assessing the impact of potential disruptions to live video and streaming functions. The CVE record and source item provide details on the unauthenticated denial-of-service vulnerability, but the corpus does not establish versions beyond V2_1.3.3 Build 260914 or provide specific details on exploitation, impact, or remediation beyond disrupting live video and streaming functions.

• Potential disruption to live video and streaming functions
• Possible adjacent-network attacks
• Verification of exposure and impact required
• Remediation priority for affected versions

Technical summary

An unauthenticated denial-of-service vulnerability exists in Tapo C325WB v2 in the RTSP streaming service on TCP port 554 when the Camera Account feature is enabled. A crafted pair of RTSP-over-HTTP tunneling requests can cause memory corruption and crash the streaming daemon. Successful exploitation may allow an unauthenticated adjacent-network attacker to disrupt live video and related streaming functions until the affected service recovers or restarts. The vulnerability affects Tapo C325WB v2 devices with the Camera Account feature enabled, and defenders should prioritize verifying exposure and assessing potential disruptions.

Defensive priority

Defenders should prioritize verifying exposure of Tapo C325WB v2 devices with the Camera Account feature enabled and assessing the impact of potential disruptions to live video and streaming functions.

Recommended defensive actions

• Verify exposure of Tapo C325WB v2 devices with the Camera Account feature enabled
• Assess the impact of potential disruptions to live video and streaming functions
• Apply firmware updates to affected versions (V2_1.3.3 Build 260914 or earlier)
• Monitor for potential adjacent-network attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the unauthenticated denial-of-service vulnerability in Tapo C325WB v2. However, the corpus does not establish versions beyond V2_1.3.3 Build 260914 or provide specific details on exploitation, impact, or remediation beyond disrupting live video and streaming functions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.