You do not have permission to edit this page, for the following reasons:
'''Evidence review addendum — 2026-10-24. Public-document review; ratings with evidence gaps remain provisional.''' This addendum supersedes earlier inconsistent wording on the same fields. It is based on public documents and the saved website snapshot; no installed device was tested. Historical research below remains historical evidence. Unverified flash protection and interface-specific controls are not verified device facts. == Documented basic information == * 电源: AC input 220–240 V, 50/60 Hz; maximum switched load 2300 W / 10 A (AU V1) [https://www.tp-link.com/au/home-networking/smart-plug/tapo-p100/v1%20(1-pack)/ Source] == Revised security evidence notes == * 闪存存储加密: At-rest flash encryption on AU P100 V1 is unverified. Public teardown/resource posts do not establish matching hardware, stock firmware or readable target flash; the resource attachment was not inspected. [https://www.elektroda.com/rtvforum/topic4093507.html Source] [https://community.home-assistant.io/t/tp-link-tapo-p100/147792/23 Source] [https://arxiv.org/html/2407.12159v1 Source] [https://www.tp-link.com/au/support/download/tapo-p100/v1/ Source] * 账号管理: The user guide linked from AU P100 V1 support documents sharing with another TP-Link ID. App guidance supports invitation and revocation; Sharing 2.0 permission tiers depend on rollout. Local multi-user accounts are not established. [https://www.tp-link.com/au/document/40414/ Source] [https://www.tp-link.com/uk/support/faq/2613/?app=kasa Source] [https://www.tp-link.com/us/support/faq/5029/ Source] * 身份认证与恢复: Cloud 2FA is an app-account control. The guide linked from AU P100 V1 support documents physical-button factory reset; current AU guidance permits offline reset without the app. Cloud-password reset and unsigned-firmware acceptance are not established. [https://www.tp-link.com/au/document/40414/ Source] [https://www.tp-link.com/au/support/faq/2612/ Source] [https://www.tp-link.com/us/support/faq/3395/ Source] * 防暴力破解: TP-Link support documents cloud-account locking after frequent failures. This supports a limited Tapo account assessment; P100 local API throttling and fixed numeric limits remain unverified. [https://community.tp-link.com/en/home/forum/topic/714488 Source] [https://www.tp-link.com/us/support/faq/3395/ Source] * 通信加密: Cloud-channel capability assessment only. The V1 certificate-validation advisory applies below the specified 1.2.6 branch fix; AU V1 release notes list 1.4.6, without proving cross-region fix equivalence. Local APIs and installed settings remain unverified. [https://www.tp-link.com/us/support/faq/4949/ Source] [https://www.tp-link.com/au/support/download/tapo-p100/v1/ Source] == Scoring status == Existing selected scores are a saved comparison baseline, not newly validated final scores. Recheck version, region and assessment path before updating options. Recalculate CATS/GRAS and synchronize this section after all selected options are settled. Do not infer a secure or insecure flash state from a downloadable firmware image or encrypted data volumes. ---- Historical scope correction: camera-specific RTSP wording in earlier P100 notes is withdrawn. P100 cloud and local plug interfaces must be assessed on their own evidence. '''Research assessment reviewed 2026-10-22. This grade is an assessor risk profile based on the stated evidence and inferences, not a test or certification of an individual installed device.''' == Assessment scope and limits == Hardware V1. Physical specs use Australian V1 page only; EU/US units may differ. Firmware below 1.2.6 is in reviewed advisory. Actual installed firmware/configuration unknown. Historical vulnerability evidence, current documented capabilities and assessor inferences are identified separately in the comments. Historical-build findings are not asserted in every patched build. Configuration-dependent benefits apply only when the specified settings are enabled. The rubric does not define numerical Rare/Very common thresholds; qualitative mappings are explained. DATE PROXY approved for this review: 3 September 2019 is the official Tapo C200/P100 series announcement, not the verified first-sale date of the selected hardware revision or Australian variant. Flash storage uses an explicitly provisional 3-point conservative assumption with low confidence; actual AU V1 at-rest protection remains unverified. This assumption is not evidence of a proven vulnerability. [https://www.tp-link.com/fr/press/news/18458/ Official Tapo series announcement at IFA] == Calculation cross-check == Device CRIS 2, 2, 1, 2, CATS 2. System CRIS 2, 1, 3, CATS 2. User Authentication CRIS 2, 1, 2, 2, 2, CATS 2. GRAS 6; expected Grade B. [https://fehmijaafar.net/wiki-iot/index.php/Methodology Methodology] == Historical vulnerabilities and remediation == === CVE-2025-15557: Improper certificate validation === * Affected scope: P100 hardware V1 firmware below 1.2.6; do not extend to other hardware versions. * Preconditions: On-path attacker on the same network segment; traffic interception position required. * Impact: Interception/modification of encrypted device-cloud communications. * Remediation: V1 firmware 1.2.6 or later, matching region. * Severity: CVSS 4.0: 7.5, vendor. * Evidence: [https://www.tp-link.com/us/support/faq/4949/ P100 V1 certificate-validation advisory] === Revision-matching exclusion === The 2024 protocol paper tested P100 hardware 1.20.0 with firmware 1.4.9/1.4.16 and a 1.5.0 fix. That is not merged with the V1 advisory below (1.2.6 fix) without verified region/revision equivalence. [https://arxiv.org/html/2407.12159v1 Original P100/C200 protocol research]
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
