CVE-2026-34126: Bluetooth Communication Uses Unencrypted Transmission During Initial Setup on TP-Link's Tapo L535E, P300 and D100C

Synopsis

This is a cleartext Bluetooth transmission vulnerability affecting TP-Link Tapo smart home devices, specifically the L535E (v1.0 and v3.0), P300 (v1.0), and D100C (v1.0). During the initial setup phase, Bluetooth communication is sent without any encryption, allowing an attacker within Bluetooth range to eavesdrop on or tamper with the setup exchange using standard sniffing or man-in-the-middle techniques. No authentication is required to exploit this; successful exploitation lets an attacker read setup credentials, manipulate configuration data, or seize unauthorized control of the device during initialization. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running an affected firmware version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityDetail

  The attacker must be physically within Bluetooth radio range (adjacent network, not reachable over the broader internet or LAN).

• AuthenticationNot required

  No credentials or account access of any kind are needed to attempt the exploit; Bluetooth sniffing and interception require no prior authentication.

• Victim interactionRequired

  A user must actively perform the initial device setup over Bluetooth, giving the attacker a window to intercept or manipulate the unencrypted exchange.

• Attack complexityDetail

  Standard Bluetooth sniffing tools are sufficient for passive eavesdropping, though man-in-the-middle manipulation introduces additional environmental timing factors that depend on the attacker being present at the exact moment of setup.

Blast Radius

• Reads cleartext setup data transmitted over Bluetooth, which may include Wi-Fi credentials or device pairing secrets used to onboard the device.
• Modifies transmitted setup data in transit, potentially redirecting the device to a rogue network or injecting malicious configuration values.
• Gains unauthorized control of the affected device during the initialization window, allowing the attacker to enroll the device under their own account or infrastructure.
• Causes limited disruption to device availability during setup (low availability impact per CVSS VA:L), potentially preventing successful initialization.