TP-Link Tapo h100 Firmware vulnerabilities

2 CVEs affecting TP-Link Tapo h100 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-15557, published 2026-02-05.

More from TP-Link.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-15557, published 2026-02-05. High severity, CVSS 8.8. EPSS: 0.2% chance of exploitation in the next 30 days. An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept and modify encrypted device-cloud…
• CVE-2024-10523, published 2024-11-04. Medium severity, CVSS 4.6. EPSS: 0.1% chance of exploitation in the next 30 days. This vulnerability exists in TP-Link IoT Smart Hub due to storage of Wi-Fi credentials in plain text within the device firmware. An attacker with physical access could exploit this by extracting the…