What is the CVSS score of CVE-2025-15557?

CVE-2025-15557 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Tapo P100 Firmware are affected by CVE-2025-15557?

TP-Link Tapo smart home devices (H100 v1 and P100 v1) contain a critical certificate validation flaw that allows attackers on the same network to intercept and modify communications between devices…

How to fix or mitigate CVE-2025-15557?

Within 24 hours: Identify and inventory all Tapo H100 v1 and P100 v1 devices in your environment using network discovery tools; isolate affected devices to a segmented VLAN if business-critical. Within 7 days: Disable cloud connectivity features if not operationally required; implement network-level monitoring for suspicious certificate validation bypass attempts. Within 30 days: Plan replacement with patched device versions; evaluate alternative vendors; document all affected assets and remediation timeline for compliance records.

Tapo P100 Firmware CVE-2025-15557

HIGH

Improper Certificate Validation (CWE-295)

2026-02-05 f23511db-6c3e-4e32-a477-6aa17d310630

TP-Link Tapo P100 Firmware Tapo H100 Firmware

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 05, 2026 - 18:16 nvd

HIGH 8.8

DescriptionCVE.org

An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypted device-cloud communications. This may compromise the confidentiality and integrity of device-to-cloud communication, enabling manipulation of device data or operations.

AnalysisAI

Technical ContextAI

Classified as CWE-295 (Improper Certificate Validation). Affects Tapo H100 Firmware. An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypted device-cloud communications. This may compromise the confidentiality and integrity of device-to-cloud communication, enabling manipulation of device data or operations.