CVE-2025-15557

HIGH

Tp-link Tapo H100 Firmware < 1.6.1 - Improper Certificate Validation

Title source: rule

Description

An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypted device-cloud communications. This may compromise the confidentiality and integrity of device-to-cloud communication, enabling manipulation of device data or operations.

References (5)

[Product] https://www.tp-link.com/en/support/download/tapo-h100/

[Product] https://www.tp-link.com/en/support/download/tapo-p100/

[Product] https://www.tp-link.com/us/support/download/tapo-h100/

[Product] https://www.tp-link.com/us/support/download/tapo-p100/

[Vendor Advisory] https://www.tp-link.com/us/support/faq/4949/

Scores

CVSS v3 8.8

EPSS 0.0001

EPSS Percentile 2.4%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-295

Status published

Affected Products (2)

tp-link/tapo_h100_firmware < 1.6.1

tp-link/tapo_p100_firmware < 1.2.6

Timeline

Published Feb 05, 2026

Tracked Since Feb 18, 2026