CVE-2025-14553 — Password Hash Leak Could Lead to Unauthorized Access on Tapo App via Local Network
Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force the password in th…
Published: 2025-12-16 · CVSS: 7.0 · CVSS 4.0
Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force the password in the local network. Issue can be mitigated through mobile application updates. Device firmware remains unchanged.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7