CVE-2025-15557
Improper Certificate Validation in TP-Link Tapo H100 and P100 Allows Man-in-the-Middle Attack
Vexday Risk Score
21Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 7.5EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Lifecycle
05 Feb 2026Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypted device-cloud communications. This may compromise the confidentiality and integrity of device-to-cloud communication, enabling manipulation of device data or operations.
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →