CVE-2025-15557
Improper Certificate Validation in TP-Link Tapo H100 and P100 Allows Man-in-the-Middle Attack
An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypted device-cloud communications. This may compromise the confidentiality and integrity of device-to-cloud communication, enabling manipulation of device data or operations.
CVSS 4.0 · 7.5 High
EPSS < 1%
KEV · Not listed
Vendors
Products