TP-Link Tapo C325WB v2
From Wiki-IoT
| TP-Link Tapo C325WB v2 | ||
|---|---|---|
|
Security Grade
Calculator v1
|
Tapo C325WB v2
Brand: TP-Link (Parent: TP-Link Systems Inc) Category: IP Camera • Model / Gen: V2 C325WB Release Date: 2024-01-01 • Status: In sale Classification Date: 2026-10-27 • Official Website | |
Contents
Security Evaluation
1. Device Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Known hardware tampering | Rare | 🔗 Proof | No physical tamper-resistant mechanism reported. |
| Known vulnerabilities | Very common | 🔗 Proof | Multiple CVEs including unauthenticated DoS (CVE-2026-105673), auth bypass, and predictable PSK. |
| Prior attacks | Rare | 🔗 Proof | Vulnerabilities disclosed in Oct 2026, but no evidence of active exploitation in the wild. |
| Updatability | Very common | 🔗 Proof | irmware patch available (V2_1.3.3 Build 260914); fixed version released. |
| Category Score | Score: 2 / 3 | ||
2. System Security
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Authentication with other systems | Partial | 🔗 Proof | ONVIF/RTSP support exists but Camera Account feature is vulnerable. |
| Communications | Encrypted with obselete encryption | 🔗 Proof | Pre-shared key for local media streaming generated with time-seeded PRNG, making it predictable. |
| Storage | Encrypted with up-to-date encryption | 🔗 Proof | Local storage on MicroSD; no specific vulnerability disclosed regarding storage encryption. |
| Category Score | Score: 2 / 3 | ||
3. User Authentication
| Criterion | Value | Proof | Comment |
|---|---|---|---|
| Account management | Basic | 🔗 Proof | Camera Account feature exists but is bypassable via CVE-2026-105672. |
| Authentication | Absent | 🔗 Proof | Unauthenticated adjacent attacker can bypass session verification and invoke privileged actions. |
| Brute-force protection | Absent | 🔗 Proof | No brute-force protection mechanism reported for the RTSP/API services. |
| Event logging | Partial logging | 🔗 Proof | No specific logging capability mentioned in vendor advisory. |
| Passwords | Default/Common/Easy to guess | 🔗 Proof | Pre-shared key is predictable and recoverable by adjacent attacker. |
| Category Score | Score: 3 / 3 | ||
Technical Specifications
| Property | Details |
|---|---|
| Operating System & App | Proprietary Embedded Linux (Companion App: Tapo App) |
| Hardware (CPU / GPU) | CPU: Unknown (Embedded SoC) • GPU: None |
| Memory & Storage | Memory: Unknown • Storage: MicroSD Card Slot (up to 512GB) |
| Power, Battery & Charging | Battery: None • Power: DC Power Adapter • Charging: None |
| Display & Camera | Display: None • Camera: Built-in IP Camera Lens |
| Sound & Connectivity | Sound: Built-in Microphone and Speaker (Two-way audio) • Connectivity: Wi-Fi (2.4GHz), Ethernet (RJ45) |
| Physical (Dimensions & Mass) | Dimensions: N/A • Mass: N/A |
Student assignment submission for IoT security assessment.
