CVE-2025-15557
Published: 05 February 2026
Summary
CVE-2025-15557 is a high-severity Improper Certificate Validation (CWE-295) vulnerability in Tp-Link Tapo H100 Firmware. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 8.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-17 (Public Key Infrastructure Certificates) and SC-8 (Transmission Confidentiality and Integrity).
Deeper analysis
CVE-2025-15557 is an Improper Certificate Validation vulnerability (CWE-295) affecting TP-Link Tapo H100 version 1 and Tapo P100 version 1 smart home devices. The flaw enables an on-path attacker on the same network segment to intercept and modify encrypted communications between the devices and TP-Link's cloud services. Published on 2026-02-05 with a CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), it undermines the security of device-to-cloud interactions.
An attacker with network adjacency, such as someone on the same local network segment, can exploit this vulnerability without authentication or user interaction. Successful exploitation allows interception and alteration of encrypted traffic, compromising the confidentiality and integrity of device data and commands. This could enable attackers to manipulate device operations, such as falsifying sensor readings or issuing unauthorized controls.
TP-Link provides firmware downloads and support resources for mitigation on their official websites, including pages for Tapo H100 and Tapo P100 at regional support portals (e.g., tp-link.com/en/support/download/tapo-h100/, tp-link.com/us/support/download/tapo-p100/) and an FAQ at tp-link.com/us/support/faq/4949/. Security practitioners should verify and apply the latest firmware updates to affected devices to address the improper certificate validation issue.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206824
Vulnerability details
An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypted device-cloud communications. This may compromise the confidentiality and integrity of device-to-cloud communication,…
more
enabling manipulation of device data or operations.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Improper certificate validation (CWE-295) directly enables on-path interception/modification of device-cloud TLS traffic, mapping to Adversary-in-the-Middle.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-17 directly mandates proper management and validation of PKI certificates, addressing the core improper certificate validation flaw in device-cloud communications.
SI-2 requires timely flaw remediation through firmware updates, as recommended by TP-Link to fix this specific certificate validation vulnerability.
SC-8 enforces cryptographic protection for transmission confidentiality and integrity, mitigating interception and modification enabled by improper certificate validation.