Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-105821— Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy

Quick assessment

Affected
TP-Link Systems Inc. Tapo Cloud Service
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Tapo 云 MQTT 代理中存在一个访问控制失效漏洞，该漏洞出现在经认证的 Tapo 设备用于请求服务令牌的代理主题中。代理服务器未验证代理请求中提供的设备 ID 是否属于当前已认证的设备。因此，拥有 Tapo 设备并知晓另一设备 ID 的攻击者，可获取针对目标设备的限定作用域设备令牌，并利用该令牌将攻击者控制的内容上传至目标用户的 Tapo 云存储。随后，该内容可在 Tapo 应用中以合法事件的形式呈现给用户。 成功利用该漏洞后，攻击者可能实现以下行为：上传由攻击者控制的内容，使其在目标用户处被误认为是合法的

CVSS 8.3 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-105821

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy
Source: CVE Program / CVE List V5
Vulnerability Description
The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo devices to request service tokens. The broker does not verify that the device ID supplied in a proxy request belongs to the authenticated device. An attacker who owns a Tapo device and knows another device's ID may obtain a device token scoped to the target device and use it to upload attacker-controlled content to the target user's Tapo Cloud storage. The content may then be presented in the Tapo app as a legitimate event. Successful exploitation may allow an attacker to upload attacker-controlled content that is presented to a target user as a legitimate Tapo event, retrieve internal service information through crafted proxy requests, or abuse Tapo Cloud outbound request capability in activity that could affect service availability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
TP-Link Systems Inc. Tapo Cloud Service 0 ~ N/A -

II. Public POCs for CVE-2026-105821

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-105821

请登录查看更多情报信息。

Other References for CVE-2026-105821 (1)

Same Patch Batch · TP-Link Systems Inc. · 2026-11-03 · 3 CVEs total

CVE-2026-105822 8.3 HIGH Server-Side Request Forgery in Tapo Cloud MQTT Proxy
CVE-2026-118865 7.3 HIGH Authenticated OS Command Injection in Archer AX3000 v2 Offline Download Component

IV. Related Vulnerabilities

Same product: Tapo Cloud Service
Same vendor: TP-Link Systems Inc.
Same weakness: CWE-862