❗❗❗Invalid cloud password on firmware build 230921 and higher

[JurajNyiri]

Thread for invalid cloud password on firmware build 230921 and higher

Notice: This issue has been locked for discussion, and will be used to post updates only. Discuss or ask a question.

There has been reports of users on firmwares 1.3.8, and newer, or on some cameras other firmwares with build 230921 and newer of integration stopping to work. This shows as cloud password not being accepted.

I have been in touch with tplink regarding a security vulnerability I reported in the past and this is most probably a fix for it.

This currently only affects some users, not all and most probably requires camera to be connected to the internet in order to receive the update for authorization, given that it affects older firmwares as well, or possibly an interaction with the official app.

I have a solution that was rejected by TPLink to be released. However, they are working on adding a new feature to the app that would allow integration to connect to cameras. They expect this to be released by mid-november 2024.

Users reported this problem in numerous issues, this issue will serve for tracking the progress on the fix and group all the conversation under one issue.

Workarounds

If you wish to use this integration, until this issue is resolved, you will need to either:

1. If your camera still works with integration: Block internet access of camera if you are using firmware build 230921 and higher
2. If your camera no longer works with integration: Block internet access and factory reset camera or Use older firmware than build 230921 and optionally factory reset camera

This post will stay uptodate with the most recent updates below.

2024-04-11:

First report of the issue at #549

2024-04-12:

Second report of the issue at #550 along with more users confirming the issue.

2024-04-13:

This thread has been created.

From my side, I have unblocked one of my camera on the latest firmware to reach the internet, so that hopefully I can get this update soon and work on a fix. I hope TPLink will provide detailed instructions on what has been changed so that I can work on a fix.

2024-04-19:

Added instructions about build number as some cameras have different versioning of firmwares.

I reached out to TP-Link after 7 days for any updates.

2024-04-23:

@reypm found a solution how to workaround this issue without downgrading the firmware:

1. Factory reset the camera (it remains with 1.3.11 Build 231117 firmware since I could not find a way to downgrade the firmware)
2. Entirely block Internet access for the camera
3. Reinstalled the component (this component)
4. Re-added the camera (by reinstalling the component it removes the old config)

TPLink is working on providing me with the solution, got a reply today that I need to wait a bit more.

2024-05-08:

I have some very good news and a little bit of concerning news.

Good news:

1. Today I was finally affected with this on one of my cameras which allowed me to conduct research and I spent my whole day working on that.
2. I now know how to solve this, I just need to figure out some of the remaining details and implement the changes which should not take more than a few weekends of active work. There is a lot of work involved but it can be done and I now know roughly how.

Now the concerning news:

1. Integration will need to interact with tplink cloud to get the new password. This is possibly a one time job, but I do not know yet, it might expire and get a new password if it no longer works. I will need to find a way to detect this as well but thats just a little detail.
2. Due to integration's need to interact with TPLink cloud I have reached out to TPLink for their permission. If they refuse, there is no way how to implement this unless someone else makes a script to extract the pwd AND the pwd does not change, ever. Which would also make the set up harder for everyone.

2024-05-15:

See #551 (comment)

2024-05-18:

See #551 (comment)

2024-05-29:

See #551 (comment)

2024-06-25:

See #551 (comment)

2024-07-03:

See #551 (comment)

2024-07-16:

See #551 (comment)

2024-07-18:

See #551 (comment)

2024-07-20:

See #551 (comment)

2024-07-31:

See #551 (comment)

2024-08-12:

See #551 (comment)

2024-08-19:

See #551 (comment)

2024-09-16:

See #551 (comment)

2024-09-20:

See #551 (comment)

2024-11-12:

See #551 (comment)

2024-12-01:

See #551 (comment)

2024-12-02:
See #551 (comment)

2024-12-13:

Victory for Local Control: TP-Link Enables Third-Party Compatibility

[reypm]

I am using the iOS app and everything is working fine. My camera is a Tapo C110 with Firmware Version 1.3.11 Build 231117 Rel. 47346n(5553) and as of today is not working.

// image removed.

[JurajNyiri]

@reypm have you opened and used the app just before it stopped working or only after?

[reypm]

@JurajNyiri Yes, everything is working as expected and nothing has changed on my end with the app, I do keep my iOS apps up to date most of the time, not sure when the Tapo app did update to the latest

[Seb-]

Hello, I have the issue on C210 with firmware 1.3.11, cloud password no longer accepted in HA.
Do you need any more information?

Thank you for the heads up!

[wavemop]

Operating System: Android
App version: 3.2.976
Camera: C200 (Hardware-Version 3.0)
Firmware version: 1.3.13

pytapo output is: "Exception: Invalid authentication data"

I'm really hoping tp-link is calling you soon ;)