The vulnerability in TP‑Link Tapo C325WB V2 arises from the use of a time‑seeded pseudo‑random number generator to create the media stream pre‑shared key. This flaw is a predictable random number generation weakness, identified as CWE-330. Because the key is predictable and can be derived by an attacker on the local network, the camera’s media streaming service can be authenticated without a valid user credential. This flaw allows anyone on an adjacent network to connect to the live video and audio streams, compromising confidentiality and integrity of the camera’s output.

Affected devices are TP‑Link Tapo C325WB model v2 cameras. No other versions or variants were specified in the advisory.

The issue is rated CVSS 8.7, indicating high risk. The exploit is possible from an unauthorized adjacent‑network attacker without authentication. Even though the EPSS score is not available, the predictable key generation makes the attack straightforward; the lack of a KEV listing does not diminish the operational impact for devices on the same local network.