CVE-2023-35717

EPSS 0.05%
Veröffentlicht 03.05.2024 02:15:34
Zuletzt bearbeitet 12.08.2025 16:36:49
Quelle zdi-disclosures@trendmicro.com
Teams Watchlist Login
Unerledigt Login

TP-Link Tapo C210 Password Recovery Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of TP-Link Tapo C210 IP cameras. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the password recovery mechanism. The issue results from reliance upon the secrecy of the password derivation algorithm when generating a recovery password. An attacker can leverage this vulnerability to bypass authentication on the system.
. Was ZDI-CAN-20484.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Tp-link ≫ Tapo C210 Firmware Version1.3.0

Tp-link ≫ Tapo C210 Versionv2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.05%	0.135

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
zdi-disclosures@trendmicro.com	8.8	2.8	5.9	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-640 Weak Password Recovery Mechanism for Forgotten Password

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

https://www.zerodayinitiative.com/advisories/ZDI-23-895/

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-35717

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-35717

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-35717

EUVD