CVE-2025-15557

High

Published: 05 February 2026

Published

05 February 2026

Modified

12 February 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0001 1.2th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-15557 is a high-severity Improper Certificate Validation (CWE-295) vulnerability in Tp-Link Tapo H100 Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 1.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-17 (Public Key Infrastructure Certificates) and SC-8 (Transmission Confidentiality and Integrity).

Threat & Defense at a Glance

What attackers do: exploitation maps to Adversary-in-the-Middle (T1557). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SC-17 Public Key Infrastructure Certificates good match

prevent

SC-17 directly mandates proper management and validation of PKI certificates, addressing the core improper certificate validation flaw in device-cloud communications.

SI-2 Flaw Remediation good match

prevent

SI-2 requires timely flaw remediation through firmware updates, as recommended by TP-Link to fix this specific certificate validation vulnerability.

SC-8 Transmission Confidentiality and Integrity good match

prevent

SC-8 enforces cryptographic protection for transmission confidentiality and integrity, mitigating interception and modification enabled by improper certificate validation.

MITRE ATT&CK Enterprise TechniquesAI

T1557 Adversary-in-the-Middle Credential Access

Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.

attack.mitre.org →

Why these techniques?

Improper certificate validation (CWE-295) directly enables on-path interception/modification of device-cloud TLS traffic, mapping to Adversary-in-the-Middle.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypted device-cloud communications. This may compromise the confidentiality and integrity of device-to-cloud communication,…

enabling manipulation of device data or operations.

Deeper analysisAI

CVE-2025-15557 is an Improper Certificate Validation vulnerability (CWE-295) affecting TP-Link Tapo H100 version 1 and Tapo P100 version 1 smart home devices. The flaw enables an on-path attacker on the same network segment to intercept and modify encrypted communications between the devices and TP-Link's cloud services. Published on 2026-02-05 with a CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), it undermines the security of device-to-cloud interactions.

An attacker with network adjacency, such as someone on the same local network segment, can exploit this vulnerability without authentication or user interaction. Successful exploitation allows interception and alteration of encrypted traffic, compromising the confidentiality and integrity of device data and commands. This could enable attackers to manipulate device operations, such as falsifying sensor readings or issuing unauthorized controls.

TP-Link provides firmware downloads and support resources for mitigation on their official websites, including pages for Tapo H100 and Tapo P100 at regional support portals (e.g., tp-link.com/en/support/download/tapo-h100/, tp-link.com/us/support/download/tapo-p100/) and an FAQ at tp-link.com/us/support/faq/4949/. Security practitioners should verify and apply the latest firmware updates to affected devices to address the improper certificate validation issue.