| TP-Link Tapo C325WB v2
|
|
Security Grade
Calculator v
|
Tapo C325WB v2
Release Date: 2024-01-01 • Status: In sale
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
No physical tamper-resistant mechanism reported.
|
| Known vulnerabilities
|
Very common
|
🔗 Proof
|
Multiple CVEs including unauthenticated DoS (CVE-2026-105673), auth bypass, and predictable PSK.
|
| Prior attacks
|
Rare
|
🔗 Proof
|
Vulnerabilities disclosed in Oct 2026, but no evidence of active exploitation in the wild.
|
| Updatability
|
Very common
|
🔗 Proof
|
irmware patch available (V2_1.3.3 Build 260914); fixed version released.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
🔗 Proof
|
ONVIF/RTSP support exists but Camera Account feature is vulnerable.
|
| Communications
|
Encrypted with obselete encryption
|
🔗 Proof
|
Pre-shared key for local media streaming generated with time-seeded PRNG, making it predictable.
|
| Storage
|
Encrypted with up-to-date encryption
|
🔗 Proof
|
Local storage on MicroSD; no specific vulnerability disclosed regarding storage encryption.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Camera Account feature exists but is bypassable via CVE-2026-105672.
|
| Authentication
|
Absent
|
🔗 Proof
|
Unauthenticated adjacent attacker can bypass session verification and invoke privileged actions.
|
| Brute-force protection
|
Absent
|
🔗 Proof
|
No brute-force protection mechanism reported for the RTSP/API services.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
No specific logging capability mentioned in vendor advisory.
|
| Passwords
|
Default/Common/Easy to guess
|
🔗 Proof
|
Pre-shared key is predictable and recoverable by adjacent attacker.
|
| Category Score
|
Score: 3 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Proprietary Embedded Linux (Companion App: Tapo App)
|
| Hardware (CPU / GPU)
|
CPU: Unknown (Embedded SoC) • GPU: None
|
| Memory & Storage
|
Memory: Unknown • Storage: MicroSD Card Slot (up to 512GB)
|
| Power, Battery & Charging
|
Battery: None • Power: DC Power Adapter • Charging: None
|
| Display & Camera
|
Display: None • Camera: Built-in IP Camera Lens
|
| Sound & Connectivity
|
Sound: Built-in Microphone and Speaker (Two-way audio) • Connectivity: Wi-Fi (2.4GHz), Ethernet (RJ45)
|
| Physical (Dimensions & Mass)
|
Dimensions: N/A • Mass: N/A
|
Student assignment submission for IoT security assessment.
