| TP-Link Tapo P100 (V1)
|
|
Security Grade
Calculator v
|
TP-Link Tapo P100 (V1)
Category: Smart Plug • Model / Gen: Tapo P100 hardware V1; Australian physical specification variant
Release Date: 2019-09-03 • Status:
|
Security Evaluation
1. Device Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Known hardware tampering
|
Rare
|
🔗 Proof
|
ASSESSOR INFERENCE: Rare denotes local-possession requirements. Power/reset controls permit service interruption or renewed onboarding; internal modification requires enclosure access. This is a physical-design estimate, not measured incident frequency.
|
| Known vulnerabilities
|
Rare
|
🔗 Proof
|
ASSESSOR INFERENCE: Rare denotes the limited verified V1 historical certificate-validation case in this review, not prevalence or a claim that no other vulnerabilities exist. The 1.2.6 fix is limited to the advisory-matched branch.
|
| Prior attacks
|
None
|
[1] 🔗 Proof
|
BOUNDED PUBLIC-RECORD ASSESSMENT: None means no confirmed model-specific field botnet incident was identified in the reviewed primary sources, which describe vulnerabilities or laboratory demonstrations. It is not proof that attacks never occurred or that device risk is absent.
|
| Updatability
|
Rare
|
[2] 🔗 Proof
|
ASSESSOR INFERENCE: Rare denotes patchability with a limited publicly verifiable revision-matched history. A matching security fix and app-based update path exist; future cadence and the installed build are not established.
|
| Category Score
|
Score: 2 / 3
|
2. System Security
| Criterion
|
Value
|
Proof
|
Comment
|
| Authentication with other systems
|
Partial
|
[3] 🔗 Proof
|
Partial describes authenticated TP-Link ID/device use with separate local onboarding/discovery paths. It does not establish mutual authentication of every local protocol or that historical validation weaknesses persist after the named fix.
|
| Communications
|
Encrypted with up-to-date encryption
|
[4] 🔗 Proof
|
Conditional current cloud-channel scope: TP-Link documents TLS 1.2/AES-128. Use patched stock firmware and official app/cloud paths. This choice excludes optional plaintext RTSP/local integrations and older affected protocols; no individual unit was packet-tested.
|
| Storage
|
No encryption
|
[5] 🔗 Proof
|
LOW-CONFIDENCE PROVISIONAL ASSUMPTION, NOT A VERIFIED DEVICE FACT: No encryption is selected as a conservative scoring scenario because AU V1 flash-at-rest protection remains unverified. An original P100 RTL8720CF teardown reports flash extraction and default encryption/hash keys, but does not establish the selected AU V1 revision, plaintext credentials, or absence of flash encryption. Network TLS does not prove flash protection. This 3-point assumption requires a matching-hardware examination before it can be treated as a finding; alternative 1- or 2-point storage scenarios also yield overall Grade B.
|
| Category Score
|
Score: 2 / 3
|
3. User Authentication
| Criterion
|
Value
|
Proof
|
Comment
|
| Account management
|
Basic
|
🔗 Proof
|
Tapo owner/shared access uses separate TP-Link IDs.
|
| Authentication
|
Secure
|
🔗 Proof
|
Assumes enabled Tapo cloud-login 2FA; local onboarding is a separate scope.
|
| Brute-force protection
|
Basic
|
[6] 🔗 Proof
|
Basic, cloud-account scope: TP-Link ID recovery guidance explicitly covers locked accounts. This supports limited cloud lockout, not a verified failed-attempt threshold or local device throttling. Cloud 2FA is a separate control.
|
| Event logging
|
Partial logging
|
🔗 Proof
|
Partial logging, cloud-account scope: official 2FA guidance describes Login Activity with IP-derived location and trusted devices. These are account-login records, not a complete local administrator audit trail.
|
| Passwords
|
Require change after setup
|
[7] 🔗 Proof
|
Users create the shared TP-Link ID password rather than retain a common factory account password. Reset rules permit 6-32 characters; stronger mixed composition is recommended, not universally enforced. The nearest 2-point bucket describes this cloud/setup-password scope.
|
| Category Score
|
Score: 2 / 3
|
Technical Specifications
| Property
|
Details
|
| Operating System & App
|
Vendor firmware; 1.2.6 or later fixes the reviewed V1 issue. (Companion App: Tapo app; TP-Link ID)
|
| Hardware (CPU / GPU)
|
CPU: • GPU:
|
| Memory & Storage
|
Memory: • Storage:
|
| Power, Battery & Charging
|
Battery: Not applicable: mains-powered smart plug • Power: • Charging:
|
| Display & Camera
|
Display: Not applicable • Camera: Not applicable
|
| Sound & Connectivity
|
Sound: • Connectivity: Australian V1: 2.4 GHz 802.11b/g/n; Bluetooth 4.2 for onboarding
|
| Physical (Dimensions & Mass)
|
Dimensions: 76.5 x 43.5 x 42 mm (Australian V1) • Mass:
|
Research assessment reviewed 2026-10-22. This grade is an assessor risk profile based on the stated evidence and inferences, not a test or certification of an individual installed device.
Assessment scope and limits
Hardware V1. Physical specs use Australian V1 page only; EU/US units may differ. Firmware below 1.2.6 is in reviewed advisory. Actual installed firmware/configuration unknown.
Historical vulnerability evidence, current documented capabilities and assessor inferences are identified separately in the comments. Historical-build findings are not asserted in every patched build. Configuration-dependent benefits apply only when the specified settings are enabled. The rubric does not define numerical Rare/Very common thresholds; qualitative mappings are explained.
DATE PROXY approved for this review: 3 September 2019 is the official Tapo C200/P100 series announcement, not the verified first-sale date of the selected hardware revision or Australian variant. Flash storage uses an explicitly provisional 3-point conservative assumption with low confidence; actual AU V1 at-rest protection remains unverified. This assumption is not evidence of a proven vulnerability. Official Tapo series announcement at IFA
Calculation cross-check
Device CRIS 2, 2, 1, 2, CATS 2. System CRIS 2, 1, 3, CATS 2. User Authentication CRIS 2, 1, 2, 2, 2, CATS 2. GRAS 6; expected Grade B. Methodology
Historical vulnerabilities and remediation
CVE-2025-15557: Improper certificate validation
- Affected scope: P100 hardware V1 firmware below 1.2.6; do not extend to other hardware versions.
- Preconditions: On-path attacker on the same network segment; traffic interception position required.
- Impact: Interception/modification of encrypted device-cloud communications.
- Remediation: V1 firmware 1.2.6 or later, matching region.
- Severity: CVSS 4.0: 7.5, vendor.
Revision-matching exclusion
The 2024 protocol paper tested P100 hardware 1.20.0 with firmware 1.4.9/1.4.16 and a 1.5.0 fix. That is not merged with the V1 advisory below (1.2.6 fix) without verified region/revision equivalence. Original P100/C200 protocol research
