Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
TP-Link has identified a vulnerability in Tapo L535E v1.0 and v3.0, Tapo P300 v1.0, and Tapo D100C v1.0, where Bluetooth communication during the initial setup phase is transmitted in cleartext without encryption. Bluetooth is only used during initialization. An attacker within the Bluetooth range could exploit this behavior using Bluetooth sniffing or man-in-the-middle techniques, which may allow eavesdropping on Bluetooth communication, manipulate transmitted setup data and potentially gain unauthorized control of the device during initialization. An attacker within the Bluetooth range could exploit this behavior using Bluetooth sniffing or man-in-the-middle techniques, which may allow eavesdropping on Bluetooth communication, manipulate transmitted setup data and potentially gain unauthorized control of the device during initialization. D100C is the chime delivered with your Tapo camera, and it is delivered with the following Tapo products: D130, D210, D235, D225, TD21, TDB21 and TD25
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
6 versions affected across 6 products
| Date | Total | Labels |
|---|
| 2026-05-28 | 1 | General1 |
| 2026-06-05 | 3 | Disclosure2Patch1 |
CVE-2026-34126はTP-Link社製IoT機器の初期設定時に使用されるBluetooth通信が暗号化されていなかったというものになります。通信データの中には機微情報が含まれるため、危機のファームウェアアップデートを強く推奨します。 https://cve.org/CVERecord?id=CVE-2026-34126 https://tp-link.com/jp/support/faq/5106/
Post summary
TP‑Link IoT devices expose sensitive information via unencrypted Bluetooth communication during initial setup; a firmware update is strongly advised to mitigate the risk.
セキュリティアドバイザリ：Tapo L535E・P300・D100Cにおける初期設定時のBluetooth通信で暗号化されていない通信が使用される脆弱性（CVE-2026-34126） https://www.tp-link.com/jp/support/faq/5106/
Post summary
A TP‑Link security advisory alerts that Tapo L535E, P300, and D100C use unencrypted Bluetooth communication during initial setup (CVE‑2026‑34126). It contains no PoC, exploit code, or active exploitation claims, nor does it mention patches.
セキュリティアドバイザリ：Tapo L535E・P300・D100Cにおける初期設定時のBluetooth通信で暗号化されていない通信が使用される脆弱性（CVE-2026-34126） | TP-Link 日本 https://www.tp-link.com/jp/support/faq/5106/
Post summary
TP‑Link Japan’s security advisory discloses an unencrypted Bluetooth communication flaw (CVE‑2026‑34126) in Tapo devices during initial setup, with no PoC, exploit code, active exploitation, or patch details mentioned in the provided excerpt.
CVE-2026-34126 Unencrypted Bluetooth Communication in TP-Link Tapo Devices During Initial Setup https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-34126
Post summary
The snippet merely references CVE-2026-34126 and its title, with no evidence of PoC, exploit, patch, or detailed technical information.
8 of 8 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | tp-link | tapo_d100c | 1.0 | - | - |
| OS | tp-link | tapo_d100c_firmware | 1.3.1 | - | - |
| HW | tp-link | tapo_l535e | 1.0 | - | - |
| HW | tp-link | tapo_l535e | 3.0 | - | - |
| OS | tp-link | tapo_l535e_firmware | 1.4.1 | - | - |
| HW | tp-link | tapo_p300 | 1.0 | - | - |
| OS | tp-link | tapo_p300_firmware | 1.4.0 | - | - |
| OS | tp-link | tapo_p300_firmware | 1.4.2 | - | - |