CVE-2025-15557 — Improper Certificate Validation in TP-Link Tapo H100 and P100 Allows Man-in-the-Middle Attack
An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypte…
Published: 2026-02-05 · CVSS: 7.5 · CVSS 4.0
An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypted device-cloud communications. This may compromise the confidentiality and integrity of device-to-cloud communication, enabling manipulation of device data or operations.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7