JVN#70631953
Multiple TP-Link products vulnerable to cleartext transmission of sensitive information

Overview

Multiple TP-Link products provided by TP-Link Systems Inc. contain Cleartext Transmission of Sensitive Information (CWE-319) vulnerability.

Products Affected

• Tapo L535E hardware version v3.0 region EU / US
  • Firmware versions prior to 1.4.1 Build 251016 Rel.204554
• Tapo L535E hardware version v1.0 region JP
  • Firmware versions prior to 1.4.1 Build 251016 Rel.204554
• Tapo P300 hardware version v1.0 region EU
  • Firmware versions prior to 1.4.2 Build 251219 Rel.142654
• Tapo P300 hardware version v1.0 region JP
  • Firmware versions prior to 1.4.0 Build 260416 Rel.014037
• Tapo D100C hardware version v1.0 region EU / JP / US
  • Firmware versions prior to 1.3.1 Build 260421 Rel.031658

• D130, D210, D235, D225, TD21, TDB21 and TD25

Description

Multiple TP-Link products provided by TP-Link Systems Inc. contain the following vulnerability.

• Cleartext transmission of sensitive information (CWE-319)
  • CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N Base Score 7.3
  • CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L Base Score 6.7
  • CVE-2026-34126

Impact

An attacker could exploit this vulnerability by performing a man-in-the-middle attack or sniffing Bluetooth communications. This could allow the attacker to intercept or modify communications, or to gain unauthorized control of the device during initialization.

Solution

Update the firmware
Update the firmware to the latest version according to the information provided by the developer.