TP-Link Tapo P100 (P100)

TP-Link Tapo P100 (P100)
Security Grade D Calculator v	TP-Link Tapo P100 (P100) Brand: TP-Link (Parent: TP-Link Systems Inc.) Category: Smart Plug • Model / Gen: P100 Release Date: 2023-01-01 • Status: In sale Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	None	—	No published hardware-tampering research for this plug was found as of 2026-10. The plug is a sealed moulded unit with no external service port.
Known vulnerabilities	Rare	[https://nvd.nist.gov/vuln/detail/CVE-2025-15557 https://nvd.nist.gov/vuln/detail/CVE-2023-38907 🔗 Proof]	Five CVEs concern this model. CVE-2025-15557 (CVSS 8.8) is an improper certificate validation flaw in Tapo H100 v1 and Tapo P100 v1 that lets an on-path attacker on the same network segment intercept traffic; NVD lists tapo_p100 explicitly in its CPE. The four 2023 flaws (CVE-2023-38906, 38907, 38908, 38909) name P100 in their descriptions and cover session replay, the TSKEP authentication function and the AES128-CBC IV, all fixed in P100 1.5.0.
Prior attacks	None	—	No campaign naming this model was found. Smart plugs are a recognised botnet target class for their always-on network presence, but no recorded attack specifically against the Tapo P100 exists. Provisional value.
Updatability	Rare	🔗 Proof	TP-Link shipped P100 1.5.0 to close the 2023 flaws and continued to publish advisories through 2025, so the update channel is active, but installation goes through the Tapo app and requires the owner to act, so plugs in the field commonly lag.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	CVE-2025-15557 is a certificate validation failure, so the identity of the party on the other end of the connection is not reliably established and an on-path attacker is accepted.
Communications	Encrypted with obselete encryption	🔗 Proof	Traffic is encrypted, but CVE-2025-15557 shows the certificate check is improper, so the encryption does not deliver the assurance it appears to. Encryption is present yet not sound, which is the obsolete-encryption case rather than no encryption.
Storage	No encryption	—	No at-rest encryption is documented for the Wi-Fi credentials held on the plug. Provisional value, not directly evidenced for this model.
Category Score	Score: 3 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Basic	—	The plug has no local account model; control is delegated entirely to the Tapo account and app. Provisional value, not directly evidenced for this model.
Authentication	Basic	🔗 Proof	Authentication exists at the app and protocol level, but CVE-2023-38906 shows sensitive information can be obtained through the authentication code path.
Brute-force protection	Absent	—	No documented lockout or rate limiting, and the practical attacks here are protocol-level rather than password guessing. Provisional value.
Event logging	Absent	—	The plug keeps no inspectable local event log; any history lives in the Tapo account. Provisional value, not directly evidenced for this model.
Passwords	Require change after setup	—	There is no per-device password on the plug; it pairs to the Tapo account, whose password is subject to complexity rules at setup. Hence require-change-after-setup rather than a default credential. Provisional value.
Category Score	Score: 3 / 3

Technical Specifications

Property	Details
Operating System & App	Embedded (Tapo firmware) (Companion App: )
Hardware (CPU / GPU)	CPU: • GPU:
Memory & Storage	Memory: • Storage:
Power, Battery & Charging	Battery: • Power: • Charging:
Display & Camera	Display: • Camera:
Sound & Connectivity	Sound: • Connectivity: Wi-Fi 2.4 GHz, Bluetooth LE (setup)
Physical (Dimensions & Mass)	Dimensions: • Mass:

The TP-Link Tapo P100 is a compact Wi-Fi smart plug, one of the highest-volume consumer smart plugs sold. Five CVEs concern it. The most serious is CVE-2025-15557 (CVSS 8.8), an improper certificate validation flaw affecting Tapo P100 v1 and H100 v1 that lets an on-path attacker on the same network segment intercept traffic; NVD lists tapo_p100 directly in the CPE. A second cluster from 2023 (CVE-2023-38906, 38907, 38908, 38909) covers session replay, the TSKEP authentication function and the AES128-CBC IV, all fixed in P100 1.5.0. The two clusters say different things about the product: the 2023 set is a cryptographic design problem that was repaired, while the 2025 certificate issue is a trust-anchor failure that undermines the encryption's promise even where the cipher itself is fine. The device is rated D, with the arithmetic stated: Device sums to 1+2+1+2 = 6, averaging 1.5 which rounds up to 2; System sums to 2+2+3 = 7, averaging 2.33 which rounds up to 3; User Authentication sums to 2+2+3+3+2 = 12, averaging 2.4 which rounds up to 3, giving a GRAS of 8. It is not rated F because no flaw here gives unauthenticated full device takeover, no exploitation campaign was found, and a smart plug controls one mains outlet rather than surveillance or physical access. Values for hardware tampering, prior attacks, storage encryption, account management, brute-force protection, event logging and password policy are provisional because no model-level TP-Link documentation could be retrieved.