CVE-2022-37255
📋 TL;DR
This vulnerability allows unauthorized access to the RTSP video feed of TP-Link Tapo C310 cameras by using hardcoded credentials (User: ---, Password: TPL075526460603). Anyone with network access to these devices can view live video streams without authentication. This affects all TP-Link Tapo C310 devices running firmware version 1.3.0.
💻 Affected Systems
- TP-Link Tapo C310
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete loss of privacy as attackers can monitor all camera feeds, potentially leading to surveillance, blackmail, or physical security breaches.
Likely Case
Unauthorized individuals accessing live video feeds to monitor private spaces without detection.
If Mitigated
If cameras are isolated on internal networks with proper segmentation, impact is limited to internal network compromise.
🎯 Exploit Status
Exploitation requires only network access and the hardcoded credentials. No special tools or skills needed beyond basic network connectivity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown - check TP-Link for latest firmware
Vendor Advisory: https://www.tp-link.com/
Restart Required: Yes
Instructions:
1. Log into TP-Link Tapo app. 2. Navigate to device settings. 3. Check for firmware updates. 4. Apply any available updates. 5. Reboot camera after update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate cameras on separate VLAN or network segment without internet access
Firewall Rules
linuxBlock RTSP port (554) access from untrusted networks
iptables -A INPUT -p tcp --dport 554 -j DROP
iptables -A INPUT -p udp --dport 554 -j DROP
🧯 If You Can't Patch
- Physically disconnect cameras from networks when not in use
- Place cameras in areas where video feed exposure would have minimal privacy impact
🔍 How to Verify
Check if Vulnerable:
Attempt to access RTSP stream using VLC or similar tool with credentials User: ---, Password: TPL075526460603 at rtsp://[camera-ip]:554/stream1Check Version:
Check firmware version in TP-Link Tapo app under device settingsVerify Fix Applied:
After update, attempt same access - should fail with authentication error📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts on RTSP service
- Successful RTSP connections using hardcoded credentials
Network Indicators:
- RTSP traffic on port 554 from unexpected sources
- Authentication strings containing 'TPL075526460603' in network captures
SIEM Query:
source_port:554 AND (user:"---" OR password:"TPL075526460603")