CVE-2025-15557 Improper Certificate Validation in TP-Link Tapo H100 and P100 Allows Man-in-the-Middle Attack
An on-path attacker can intercept and modify encrypted communications between TP-Link Tapo devices and the cloud due to improper certificate validation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-15557?
CVE-2025-15557 is a high-severity vulnerability in TP-Link Systems Inc. Tapo H100 v1, published on 5 Feb 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypted device-cloud communications. This may compromise the confidentiality and integrity of device-to-cloud communication, enabling manipulation of device data or operations.
Weakness: CWE-295
Which versions are affected by CVE-2025-15557?
It affects 2 products.
Products include Tp-Link Tapo H100 Firmware, Tp-Link Tapo P100 Firmware.
How do I fix CVE-2025-15557?
No fix has been published for CVE-2025-15557 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-15557 being exploited?
There is no known exploitation of CVE-2025-15557 in the wild and no public exploit code.
Other vulnerabilities in TP-Link Systems Inc. Tapo H100 v1
Sources
Also known as GHSA-2x8h-ggxv-ww4j.