CVE-2025-14553

HIGH

TP-Link Tapo App < 3.1.6 - Unauthenticated Password Hash Exposure via API Response

Title source: llm
STIX 2.1

Description

Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force the password in the local network. Issue can be mitigated through mobile application updates. Device firmware remains unchanged.

References (3)

Core 3

Scores

CVSS v4 7.0
EPSS 0.0017
EPSS Percentile 7.0%
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (2)
TP-Link Systems Inc./TP-Link Tapo App < 3.1.6
TP-Link Systems Inc./TP-Link Tapo App < 3.1.601
Published Dec 16, 2025
Tracked Since Feb 18, 2026