TP‑Link Tapo C325WB v2 includes a flaw in the HTTPS JSON API dispatcher that allows an unauthenticated attacker on the adjacent network to append an onboarding‑scoped object to a JSON request, thus bypassing session verification and invoking privileged actions. The result is that the attacker can access and stream live video and audio, alter device settings, and retrieve sensitive device information or secrets. This vulnerability effectively grants full control over the device without requiring any valid credentials.

The affected product is TP‑Link Tapo C325WB v2. No other vendors, products, or versions are listed as impacted.

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an adjacent‑network attacker sending HTTPS JSON requests to the device on TCP port 443. With access to the local network and no authentication, exploitation is straightforward and could lead to complete device takeover.