TP‑Link Tapo C210 firmware 3.60 contains a flaw that allows an unauthenticated attacker to retrieve shared credential material and cryptographic metadata through DS JSON API requests. The exposed credential can be used as an administrative password by the device’s Digest authentication, enabling an attacker to establish encrypted media sessions without knowing the legitimate account password. This results in unauthorized access to video streams and potential disclosure of credential data. This flaw is identified as CWE‑287.

The vulnerability affects the TP‑Link Tapo C210 device running firmware version 3.60, as identified by TP‑Link Systems Inc. No other products or versions are listed.

The CVSS score of 7.1 indicates a high severity impact. EPSS data is unavailable, and the issue is not yet listed in the CISA KEV catalog, so current exploitation probability is unknown. Given that no authentication is required for the API calls, a local network or adjacent‑network attacker can exploit the flaw to gain access to encrypted media sessions if the device is reachable. The high severity and trivial access conditions warrant prompt attention.