High severity8.8NVD Advisory· Published Feb 5, 2026· Updated Jun 17, 2026

CVE-2025-15557

Description

An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypted device-cloud communications. This may compromise the confidentiality and integrity of device-to-cloud communication, enabling manipulation of device data or operations.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

TP-Link/Tapo H100 Firmware
cpe:2.3:o:tp-link:tapo_h100_firmware:*:*:*:*:*:*:*:*
Range: <1.6.1
TP-Link/Tapo P100 Firmware
cpe:2.3:o:tp-link:tapo_p100_firmware:*:*:*:*:*:*:*:*
Range: <1.2.6
TP-Link/Tapo H100 V1llm-fuzzy2 versions
v1+ 1 more
- (no CPE)range: v1
- (no CPE)range: 0
TP-Link/Tapo P100llm-fuzzy
Range: v1

Patches

Vulnerability mechanics

References

www.tp-link.com/us/support/faq/4949/nvdVendor Advisory
www.tp-link.com/en/support/download/tapo-h100/nvdProduct
www.tp-link.com/en/support/download/tapo-p100/nvdProduct
www.tp-link.com/us/support/download/tapo-h100/nvdProduct
www.tp-link.com/us/support/download/tapo-p100/nvdProduct

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000