Vulnerability · Published Feb 10, 2025 · Assigned by CERT-In

CVE-2025-1099Information Disclosure Vulnerability in TP-Link Tapo C500 Wi-Fi Camera

High 7.0

In plain English

A high-severity security flaw in Tapo C500 V1 Wi-Fi Camera from TP-Link. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 4.0)7.0High

Exploit odds (30 days)0.3%top 82.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

This vulnerability exists in Tapo C500 Wi-Fi camera due to hard-coded RSA private key embedded within the device firmware. An attacker with physical access could exploit this vulnerability to obtain cryptographic private keys which can then be used to perform impersonation, data decryption and man in the middle attacks on the targeted device.

Affected products (as reported)

Vendor	Product	Versions
TP-Link	Tapo C500 V1 Wi-Fi Camera	<=1.1.4
TP-Link	Tapo C500 V2 Wi-Fi Camera	<=1.0.2

Weakness: CWE-321 · Vector: CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0017 third-party-advisory