TP-Link Tapo P100 (V1)

From Wiki-IoT
Revision as of 01:50, 22 October 2026 by Huixin Lin (talk | contribs)


Evidence review: 2026-10-21. Overall IDRS grade: not assigned.

All 12 criteria are investigated below. A documented capability, a historical vulnerability and an observed current configuration are different evidence types. Unresolved values are explicitly not scored; absence of a public report is not evidence of absence.

Classification form fields are stored in this page. The evidence table is displayed while required ratings remain unresolved, so no overall grade is assigned. Blank rating choices mean insufficient evidence, not None or Absent.

Product information

Field Verified value / stated scope
Name TP-Link Tapo P100
Brand TP-Link
Model Tapo P100 hardware V1; Australian physical specification variant
Operating System Vendor firmware; 1.2.6 or later fixes the reviewed V1 issue.
Companion App Tapo app; TP-Link ID
Connectivity Australian V1: 2.4 GHz 802.11b/g/n; Bluetooth 4.2 for onboarding
Dimensions 76.5 x 43.5 x 42 mm (Australian V1)
Battery Not applicable: mains-powered smart plug
Display Not applicable
Camera Not applicable
Type Smart Plug
Website https://www.tp-link.com/au/home-networking/smart-plug/tapo-p100/v1%20(1-pack)/

Assessment scope

Hardware V1. Physical specs use Australian V1 page only; EU/US units may differ. Firmware below 1.2.6 is in reviewed advisory. Actual installed firmware/configuration unknown.

No physical device, installed firmware, password, network trace or storage image was inspected. Conditional capability assessments apply only when the named settings are enabled.

Security evaluation

Device

Criterion Finding / rubric choice Evidence and reasoning
Known hardware tampering Not rated: insufficient evidence Physical features are documented; a model-specific tampering-frequency assessment was not established. Exposed physical features alone are not a measured tampering rate. P100 AU V1 specifications
Known vulnerabilities Confirmed vulnerabilities; frequency not quantified The records below establish historical vulnerabilities within the stated firmware scope. They do not measure prevalence or establish a Rare/Very common frequency rating. P100 V1 certificate-validation advisory
Prior attacks Not rated: insufficient evidence Model-specific field-attack frequency was not established. Research demonstrations are not incident counts. P100 V1 certificate-validation advisory
Updatability Not rated: insufficient evidence 2026 advisory documents a V1 fix; continuing update frequency/lifecycle not established. P100 V1 certificate-validation advisory P100 AU V1 downloads

System

Criterion Finding / rubric choice Evidence and reasoning
Authentication with other systems Not rated: insufficient evidence Old peer-validation failure does not establish the fixed complete mutual-authentication design. P100 V1 certificate-validation advisory
Communications Not rated: insufficient evidence Encrypted cloud traffic is documented; post-fix cipher/protocol details and other channels unverified. P100 V1 certificate-validation advisory
Storage Not rated: insufficient evidence Flash protection for Wi-Fi credentials and device secrets was not established. The methodology refers specifically to device flash, not just user disks, removable media, or encrypted network traffic. P100 V1 certificate-validation advisory P100 AU V1 specifications

User authentication

Criterion Finding / rubric choice Evidence and reasoning
Account management Basic (CRIS 2; scoped assessment) Tapo owner/shared access uses separate TP-Link IDs. Tapo device sharing guidance
Authentication Secure (CRIS 1; scoped assessment) Assumes enabled Tapo cloud-login 2FA; local onboarding is a separate scope. Tapo app 2FA
Brute-force protection Cloud lockout mentioned; local protection unverified TP-Link ID guidance includes account-locked recovery. No reliable model/build-specific camera or plug failed-login threshold was established. Cloud 2FA is a separate control and does not prove a local guessing limit. TP-Link ID password reset policy Tapo app 2FA
Event logging Not rated: insufficient evidence Schedules/switch events do not establish authentication audit logs. P100 AU V1 specifications
Passwords User-selected TP-Link ID password; device policy unverified The shared TP-Link ID has a user-selected password; current reset guidance specifies 6 to 32 characters without spaces and recommends stronger composition. Recommendations must not be described as enforced complexity. Local device credentials/onboarding require separate assessment. TP-Link ID password reset policy Shared TP-Link ID account

Rating calculation

No definitive category score or GRAS is calculated while one or more required CRIS values are unresolved. The method requires taking the ceiling of each complete category mean and summing the three category scores. An unknown must not be substituted with 1 or treated as None. Wiki-IoT methodology

Historical vulnerabilities and remediation

CVE-2025-15557: Improper certificate validation

  • Affected scope: P100 hardware V1 firmware below 1.2.6; do not extend to other hardware versions.
  • Preconditions: On-path attacker on the same network segment; traffic interception position required.
  • Impact: Interception/modification of encrypted device-cloud communications.
  • Remediation: V1 firmware 1.2.6 or later, matching region.
  • Severity: CVSS 4.0: 7.5, vendor.

Revision-matching exclusion

The 2024 protocol paper tested P100 hardware 1.20.0 with firmware 1.4.9/1.4.16 and a 1.5.0 fix. That is not merged with the V1 advisory below (1.2.6 fix) without verified region/revision equivalence. Original P100/C200 protocol research

Product evidence notes

Retrieved from "http://fehmijaafar.net/wiki-iot/index.php?title=TP-Link_Tapo_P100_(V1)&oldid=8666"