TP-Link Tapo P100 (V1)

TP-Link Tapo P100 (V1)
Security Grade B Calculator v	TP-Link Tapo P100 (V1) Brand: TP-Link Category: Smart Plug • Model / Gen: Tapo P100 hardware V1; Australian physical specification variant Release Date: 2019-09-03 • Status: Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	ASSESSOR INFERENCE: Rare denotes local-possession requirements. Power/reset controls permit service interruption or renewed onboarding; internal modification requires enclosure access. This is a physical-design estimate, not measured incident frequency.
Known vulnerabilities	Rare	🔗 Proof	ASSESSOR INFERENCE: Rare denotes the limited verified V1 historical certificate-validation case in this review, not prevalence or a claim that no other vulnerabilities exist. The 1.2.6 fix is limited to the advisory-matched branch.
Prior attacks	None	[1] 🔗 Proof	BOUNDED PUBLIC-RECORD ASSESSMENT: None means no confirmed model-specific field botnet incident was identified in the reviewed primary sources, which describe vulnerabilities or laboratory demonstrations. It is not proof that attacks never occurred or that device risk is absent.
Updatability	Rare	[2] 🔗 Proof	ASSESSOR INFERENCE: Rare denotes patchability with a limited publicly verifiable revision-matched history. A matching security fix and app-based update path exist; future cadence and the installed build are not established.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	[3] 🔗 Proof	Partial describes authenticated TP-Link ID/device use with separate local onboarding/discovery paths. It does not establish mutual authentication of every local protocol or that historical validation weaknesses persist after the named fix.
Communications	Encrypted with up-to-date encryption	[4] 🔗 Proof	Cloud-channel capability assessment only. The V1 certificate-validation advisory applies below the specified 1.2.6 branch fix; AU V1 release notes list 1.4.6, without proving cross-region fix equivalence. Local APIs and installed settings remain unverified.
Storage	No encryption	[5] [6] [7] 🔗 Proof	At-rest flash encryption on AU P100 V1 is unverified. Public teardown/resource posts do not establish matching hardware, stock firmware or readable target flash; the resource attachment was not inspected.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	[8] [9] 🔗 Proof	The user guide linked from AU P100 V1 support documents sharing with another TP-Link ID. App guidance supports invitation and revocation; Sharing 2.0 permission tiers depend on rollout. Local multi-user accounts are not established.
Authentication	Secure	[10] [11] 🔗 Proof	Cloud 2FA is an app-account control. The guide linked from AU P100 V1 support documents physical-button factory reset; current AU guidance permits offline reset without the app. Cloud-password reset and unsigned-firmware acceptance are not established.
Brute-force protection	Basic	[12] 🔗 Proof	TP-Link support documents cloud-account locking after frequent failures. This supports a limited Tapo account assessment; P100 local API throttling and fixed numeric limits remain unverified.
Event logging	Partial logging	🔗 Proof	Partial logging, cloud-account scope: official 2FA guidance describes Login Activity with IP-derived location and trusted devices. These are account-login records, not a complete local administrator audit trail.
Passwords	Require change after setup	[13] 🔗 Proof	Users create the shared TP-Link ID password rather than retain a common factory account password. Reset rules permit 6-32 characters; stronger mixed composition is recommended, not universally enforced. The nearest 2-point bucket describes this cloud/setup-password scope.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Vendor firmware; 1.2.6 or later fixes the reviewed V1 issue. (Companion App: Tapo app; TP-Link ID)
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: Not applicable: mains-powered smart plug • Power: AC input 220–240 V, 50/60 Hz; maximum switched load 2300 W / 10 A (AU V1) • Charging:
Display & Camera	Display: Not applicable • Camera: Not applicable
Sound & Connectivity	Sound: • Connectivity: Australian V1: 2.4 GHz 802.11b/g/n; Bluetooth 4.2 for onboarding
Physical (Dimensions & Mass)	Dimensions: 76.5 x 43.5 x 42 mm (Australian V1) • Mass:

Evidence review addendum — 2026-10-24. Public-document review; ratings with evidence gaps remain provisional.

This addendum supersedes earlier inconsistent wording on the same fields. It is based on public documents and the saved website snapshot; no installed device was tested. Historical research below remains historical evidence. Unverified flash protection and interface-specific controls are not verified device facts.

Documented basic information

• 电源: AC input 220–240 V, 50/60 Hz; maximum switched load 2300 W / 10 A (AU V1) Source

Revised security evidence notes

• 闪存存储加密: At-rest flash encryption on AU P100 V1 is unverified. Public teardown/resource posts do not establish matching hardware, stock firmware or readable target flash; the resource attachment was not inspected. Source Source Source Source
• 账号管理: The user guide linked from AU P100 V1 support documents sharing with another TP-Link ID. App guidance supports invitation and revocation; Sharing 2.0 permission tiers depend on rollout. Local multi-user accounts are not established. Source Source Source
• 身份认证与恢复: Cloud 2FA is an app-account control. The guide linked from AU P100 V1 support documents physical-button factory reset; current AU guidance permits offline reset without the app. Cloud-password reset and unsigned-firmware acceptance are not established. Source Source Source
• 防暴力破解: TP-Link support documents cloud-account locking after frequent failures. This supports a limited Tapo account assessment; P100 local API throttling and fixed numeric limits remain unverified. Source Source
• 通信加密: Cloud-channel capability assessment only. The V1 certificate-validation advisory applies below the specified 1.2.6 branch fix; AU V1 release notes list 1.4.6, without proving cross-region fix equivalence. Local APIs and installed settings remain unverified. Source Source

Scoring status

Existing selected scores are a saved comparison baseline, not newly validated final scores. Recheck version, region and assessment path before updating options. Recalculate CATS/GRAS and synchronize this section after all selected options are settled. Do not infer a secure or insecure flash state from a downloadable firmware image or encrypted data volumes.

---

Historical scope correction: camera-specific RTSP wording in earlier P100 notes is withdrawn. P100 cloud and local plug interfaces must be assessed on their own evidence.

Research assessment reviewed 2026-10-22. This grade is an assessor risk profile based on the stated evidence and inferences, not a test or certification of an individual installed device.

Assessment scope and limits

Hardware V1. Physical specs use Australian V1 page only; EU/US units may differ. Firmware below 1.2.6 is in reviewed advisory. Actual installed firmware/configuration unknown.

Historical vulnerability evidence, current documented capabilities and assessor inferences are identified separately in the comments. Historical-build findings are not asserted in every patched build. Configuration-dependent benefits apply only when the specified settings are enabled. The rubric does not define numerical Rare/Very common thresholds; qualitative mappings are explained.

DATE PROXY approved for this review: 3 September 2019 is the official Tapo C200/P100 series announcement, not the verified first-sale date of the selected hardware revision or Australian variant. Flash storage uses an explicitly provisional 3-point conservative assumption with low confidence; actual AU V1 at-rest protection remains unverified. This assumption is not evidence of a proven vulnerability. Official Tapo series announcement at IFA

Calculation cross-check

Device CRIS 2, 2, 1, 2, CATS 2. System CRIS 2, 1, 3, CATS 2. User Authentication CRIS 2, 1, 2, 2, 2, CATS 2. GRAS 6; expected Grade B. Methodology

Historical vulnerabilities and remediation

CVE-2025-15557: Improper certificate validation

• Affected scope: P100 hardware V1 firmware below 1.2.6; do not extend to other hardware versions.

• Preconditions: On-path attacker on the same network segment; traffic interception position required.

• Impact: Interception/modification of encrypted device-cloud communications.

• Remediation: V1 firmware 1.2.6 or later, matching region.

• Severity: CVSS 4.0: 7.5, vendor.

• Evidence: P100 V1 certificate-validation advisory

Revision-matching exclusion

The 2024 protocol paper tested P100 hardware 1.20.0 with firmware 1.4.9/1.4.16 and a 1.5.0 fix. That is not merged with the V1 advisory below (1.2.6 fix) without verified region/revision equivalence. Original P100/C200 protocol research