TP-Link Tapo P100 Smart Plug

TP-Link Tapo P100 Smart Plug
Security Grade C Calculator v1	TP-Link Tapo P100 Mini Smart Wi-Fi Socket Brand: TP-Link Category: Smart Plug • Model / Gen: P100 Release Date: 2021-01-01 • Status: In sale Classification Date: 2026-11-01 • Official Website

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	None	🔗 Proof	Smart plug has minimal physical attack value. Disassembly provides little security advantage.
Known vulnerabilities	Rare	🔗 Proof	Documented vulnerabilities include improper certificate validation allowing MITM attacks (CVE-2025-15557) and password hash leak via local network API (CVE-2025-14553). Both patched in latest firmware.
Prior attacks	None	🔗 Proof	Smart plugs have not been used in large-scale botnet campaigns. They are not a primary target due to limited processing power.
Updatability	Very common	🔗 Proof	TP-Link pushes regular OTA firmware updates to Tapo devices via the mobile app. Security vulnerabilities are patched promptly.
Category Score	Score: 2 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	Cloud communications require Tapo account authentication, but local API has historically had weak authentication. CVE-2025-14553 exposed password hashes via unauthenticated local API.
Communications	Encrypted with obselete encryption	🔗 Proof	Cloud communications use TLS, but CVE-2025-15557 showed improper certificate validation allowing man-in-the-middle attacks on the same network.
Storage	No encryption	🔗 Proof	Plug stores minimal configuration data. No sensitive user data stored locally beyond Wi-Fi credentials and device settings.
Category Score	Score: 3 / 3

Criterion	Value	Proof	Comment
Account management	Basic	🔗 Proof	Tapo app supports basic user management and device sharing, but permission controls are limited. No role-based access.
Authentication	Basic	🔗 Proof	Password-based authentication. Two-factor authentication available but not mandatory.
Brute-force protection	Basic	🔗 Proof	Cloud accounts have basic rate limiting. Local API had no protection before CVE-2025-14553 was patched.
Event logging	Partial logging	🔗 Proof	App provides basic on/off history and device activity logs. No detailed security event logs exposed to users.
Passwords	Require change after setup	🔗 Proof	Users must set a Tapo account password during device setup. Complexity requirements are moderate.
Category Score	Score: 2 / 3