CVE-2025-15557

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypted device-cloud communications. This may compromise the confidentiality and integrity of device-to-cloud communication, enabling manipulation of device data or operations.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
TP-Link Systems Inc.	Tapo H100 v1	< 1.6.1
TP-Link Systems Inc.	Tapo P100 v1	< 1.2.6

References

https://www.tp-link.com/en/support/download/tapo-h100/Product
https://www.tp-link.com/en/support/download/tapo-p100/Product
https://www.tp-link.com/us/support/download/tapo-h100/Product
https://www.tp-link.com/us/support/download/tapo-p100/Product
https://www.tp-link.com/us/support/faq/4949/Vendor Advisory

Timeline

Published: Feb 5, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-155588.0Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-CVE-2025-155599.8An unauthenticated attacker can inject OS commands when calling a server API endpoint in NesterSoft WorkTime. The server API call to generat CVE-2025-15569.8A vulnerability, which was classified as problematic, has been found in westboy CicadasCMS 1.0. This issue affects some unknown processing o CVE-2025-155608.8An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL qu CVE-2025-155617.8An attacker can exploit the update behavior of the WorkTime monitoring daemon to elevate privileges on the local system to NT Authority\SYST CVE-2025-155626.1The server API endpoint /report/internet/urls reflects received data into the HTML response without applying proper encoding or filtering. T CVE-2025-155635.3Any unauthenticated user can reset the WorkTime on-prem database configuration by sending a specific HTTP request to the WorkTime server. No CVE-2025-155645.5A vulnerability has been found in Mapnik up to 4.2.0. This vulnerability affects the function mapnik::detail::mod<...>::operator of the file CVE-2025-155655.3The Nexi XPay plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the redirect fu CVE-2025-155668.8A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-proxy-set-headers` Ingress annotation can be us CVE-2025-155673.3Insufficient protection mechanisms in the Health Module may lead to partial information disclosure.CVE-2025-155688.0A command injection vulnerability was identified in the web module of Archer AXE75 v1.6/v1.0 router. An authenticated attacker with adjacen