What’s Vulnerable › Vulnerabilities

CVE-2026-102368: Plaintext Storage of a Device-Specific Private Key in Tapo S505 Firmware

• Severity: medium (CVSS 5.4 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-08 · updated 2026-10-09
• Weakness: CWE-312

Description

Affected Tapo device firmware stores device-specific cryptographic material in plaintext within nonvolatile storage. An attacker with physical access to an affected device can recover this sensitive material from the firmware.  Successful exploitation of this vulnerability may result in the disclosure of device-specific cryptographic material and could, under certain conditions, increase the risk of unauthorized access to related protected information or communications.

Affected products

• TP-Link System Inc. Tapo S505 v1.6: before 1.4.1 Build 260713 — fixed in 1.4.1 Build 260713

How to fix

Upgrade to a fixed version: TP-Link System Inc. Tapo S505 v1.6 1.4.1 Build 260713. Check the vendor advisory for mitigations.

References

• https://www.tp-link.com/us/support/download/tapo-s505/#Firmware-Release-Notes
• https://www.tp-link.com/us/support/faq/5332/

Get alerted when CVE-2026-102368 or the next vulnerability affects your stack