What’s Vulnerable › Vulnerabilities

CVE-2025-14553: Password Hash Leak Could Lead to Unauthorized Access on Tapo App via Local Network

• Severity: high (CVSS 7.0 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-16 · updated 2026-06-17
• Weakness: CWE-200

Description

Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force the password in the local network. Issue can be mitigated through mobile application updates. Device firmware remains unchanged.

Affected products

• TP-Link Systems Inc. TP-Link Tapo App: before 3.1.6; before 3.1.601 — fixed in 3.1.6, 3.1.601

How to fix

Upgrade to a fixed version: TP-Link Systems Inc. TP-Link Tapo App 3.1.6, 3.1.601. Check the vendor advisory for mitigations.

References

• https://apps.apple.com/us/app/tp-link-tapo/id1472718009
• https://play.google.com/store/apps/details?id=com.tplink.iot
• https://www.tp-link.com/us/support/faq/4840/

Get alerted when CVE-2025-14553 or the next vulnerability affects your stack