CVE-2025-1099 HIGH

CVE-2025-1099: Information Disclosure Vulnerability in TP-Link Tapo C500 Wi-Fi Camera

Vendor Tp-Link
Product Tapo C500 V1 Wi-Fi Camera
Weakness CWE-321
Published February 10, 2025
Last update February 14, 2025
View on NVD All CVEs

CVSS base score

7.0/10
Attack vector Physical
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

This vulnerability exists in Tapo C500 Wi-Fi camera due to hard-coded RSA private key embedded within the device firmware. An attacker with physical access could exploit this vulnerability to obtain cryptographic private keys which can then be used to perform impersonation, data decryption and man in the middle attacks on the targeted device.

Key dates

02Disclosure timeline

February 10, 2025 CVE published
February 14, 2025 Record updated