You do not have permission to edit this page, for the following reasons:
The TP-Link Tapo P100 is a compact Wi-Fi smart plug, one of the highest-volume consumer smart plugs sold. Five CVEs concern it. The most serious is CVE-2025-15557 (CVSS 8.8), an improper certificate validation flaw affecting Tapo P100 v1 and H100 v1 that lets an on-path attacker on the same network segment intercept traffic; NVD lists tapo_p100 directly in the CPE. A second cluster from 2023 (CVE-2023-38906, 38907, 38908, 38909) covers session replay, the TSKEP authentication function and the AES128-CBC IV, all fixed in P100 1.5.0. The two clusters say different things about the product: the 2023 set is a cryptographic design problem that was repaired, while the 2025 certificate issue is a trust-anchor failure that undermines the encryption's promise even where the cipher itself is fine. The device is rated D, with the arithmetic stated: Device sums to 1+2+1+2 = 6, averaging 1.5 which rounds up to 2; System sums to 2+2+3 = 7, averaging 2.33 which rounds up to 3; User Authentication sums to 2+2+3+3+2 = 12, averaging 2.4 which rounds up to 3, giving a GRAS of 8. It is not rated F because no flaw here gives unauthenticated full device takeover, no exploitation campaign was found, and a smart plug controls one mains outlet rather than surveillance or physical access. Values for hardware tampering, prior attacks, storage encryption, account management, brute-force protection, event logging and password policy are provisional because no model-level TP-Link documentation could be retrieved.
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
