JVN#70631953    
Multiple TP-Link products vulnerable to cleartext transmission of sensitive information

Multiple TP-Link products provided by TP-Link Systems Inc. contain Cleartext Transmission of Sensitive Information (CWE-319) vulnerability.

• Tapo L535E hardware version v3.0 region EU / US
  • Firmware versions prior to 1.4.1 Build 251016 Rel.204554
• Tapo L535E hardware version v1.0 region JP
  • Firmware versions prior to 1.4.1 Build 251016 Rel.204554
• Tapo P300 hardware version v1.0 region EU
  • Firmware versions prior to 1.4.2 Build 251219 Rel.142654
• Tapo P300 hardware version v1.0 region JP
  • Firmware versions prior to 1.4.0 Build 260416 Rel.014037
• Tapo D100C hardware version v1.0 region EU / JP / US
  • Firmware versions prior to 1.3.1 Build 260421 Rel.031658

Note: D100C is the chime delivered with Tapo cameras, and it is delivered with the following Tapo products:

• D130, D210, D235, D225, TD21, TDB21 and TD25

Multiple TP-Link products provided by TP-Link Systems Inc. contain the following vulnerability.

• Cleartext transmission of sensitive information (CWE-319)
  • CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N Base Score 7.3
  • CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L Base Score 6.7
  • CVE-2026-34126

An attacker could exploit this vulnerability by performing a man-in-the-middle attack or sniffing Bluetooth communications. This could allow the attacker to intercept or modify communications, or to gain unauthorized control of the device during initialization.

Update the firmware
Update the firmware to the latest version according to the information provided by the developer.

Vendor	Link
TP-Link Systems Inc.	Security Advisory: Bluetooth Communication Uses Unencrypted Transmission During Initial Setup on Tapo L535E, P300 and D100C (CVE-2026-34126)

eyegrep and izurina of L Plus LLC reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.