Is CVE-2026-105674 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105674 being exploited in the wild.

How severe is CVE-2026-105674?

Informational severity, published 8 October 2026.

Is there a fix for CVE-2026-105674?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-105674 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-105674?

Check whether you run TP-Link Tapo C325WB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105674: TP-Link Tapo C325WB V2 weak PSK generation in media streaming

CVE-2026-105674 · Severity: info · Published 2026-10-08

The TP-Link Tapo C325WB V2 is an outdoor security camera that streams video and audio over the local network. Its media streaming service generates the pre-shared key using only the current time as a seed, making the key predictable. An attacker on the same network can recover this key and access live camera feeds without valid credentials, compromising the confidentiality and integrity of all video and audio.

Vendors: TP-Link.

Quick answers

Is CVE-2026-105674 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105674 being exploited in the wild.
How severe is CVE-2026-105674?: Informational severity, published 8 October 2026.
Which products and versions are affected?: TP-Link Tapo C325WB V2.
Is there a fix for CVE-2026-105674?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-105674 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-105674?: Check whether you run TP-Link Tapo C325WB at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a weak cryptographic key generation flaw in the local media streaming service. The pre-shared key is generated using a time-seeded pseudo-random number generator, allowing unauthenticated adjacent-network attackers to predict or recover the key through brute-force based on timing. Successful exploitation grants access to live video and audio streams without authentication.

Affected products

TP-Link Tapo C325WB V2

Timeline

2026-10-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.