Three high-severity vulnerabilities in TP-Link’s Tapo C325WB V2 could let attackers on the same network bypass authentication, disrupt streaming or recover predictable keys for live video and audio.
TP-Link has disclosed three high-severity flaws in the Tapo C325WB V2 smart camera, a device used for home and small-business surveillance. The company says the issues affect the camera’s web-facing and streaming components and could let an attacker on the same local network bypass authentication, interrupt video services or recover a stream key that should not be guessable. According to TP-Link’s advisory, the most serious of the three vulnerabilities carries a CVSS v4.0 score of 8.7, placing it in the high-severity range.
One flaw affects the camera’s HTTPS JSON API on port 443. TP-Link says an adjacent-network attacker can append a specially crafted onboarding object to a request and bypass session verification, which may allow unauthorised access to live video and audio, changes to device settings and exposure of sensitive device information. A second issue affects the RTSP streaming service on port 554 when the Camera Account feature is enabled. In that case, crafted RTSP-over-HTTP tunnelling requests can trigger memory corruption and crash the streaming daemon, temporarily disrupting live feeds and related functions.
The third vulnerability is more directly tied to stream confidentiality. TP-Link says the local media streaming service generates its pre-shared key using a time-seeded pseudo-random number generator, making the key predictable and recoverable. In practical terms, that could allow an attacker on the same network to authenticate to the stream without valid credentials and take control of live video and audio. Security Online reported that no confirmed exploitation in the wild has been observed so far, but the risk is clear: a compromised camera can undermine both privacy and physical security.
TP-Link says the affected hardware is the Tapo C325WB V2 and that the fixed firmware is V2_1.3.3 Build 260914. The company is urging users to update through the Tapo mobile application as soon as possible. For households and small offices, the advisory is a reminder that smart cameras are only as secure as the local network around them. Strong Wi-Fi encryption and prompt firmware patching remain the most effective immediate defences.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
