An attacker can craft a JSON request sent to the DS JSON API of the Tapo C210 camera. The crafted payload contains both public onboarding data and protected operations, causing the device’s module‑level authorization checks to be applied inconsistently. This inconsistency allows the attacker to execute camera functions that normally require a valid authenticated session, such as pan‑tilt‑zoom control, without any credentials. The flaw maps to CWE‑287, an authentication bypass weakness.

TP‑Link Systems Inc. produces the Tapo C210 smart camera. Firmware version 3.60 is identified as vulnerable. No additional vendors, products, or versions are listed as affected in the available data.

The vulnerability carries a CVSS score of 5.3, categorizing it as moderate severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, so real‑world exploitation likelihood is not quantified. The attack vector is a local or adjacent network attacker who can reach the device’s DS JSON API endpoint; no special privileges or authentication are required beyond network connectivity. Successful exploitation grants the attacker control over camera operations.