CVE-2025-9293: Insufficient Certificate Validation in Multiple Mobile Applications Allows Man in the Middle Interception

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-13 · updated 2026-06-17
Weakness: CWE-295

Description

A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication. An attacker in a privileged network position may be able to intercept or modify traffic if they can position themselves within the communication channel. Successful exploitation may compromise confidentiality, integrity, and availability of application data.

Affected products

TP-Link Aginet: before 2.13.6 — fixed in 2.13.6
TP-Link Deco: before 3.9.163 — fixed in 3.9.163
TP-Link Festa: before 1.7.1 — fixed in 1.7.1
TP-Link Kasa: before 3.4.350 — fixed in 3.4.350
TP-Link Systems Inc. KidShield: before 1.1.21 — fixed in 1.1.21
TP-Link Omada: before 4.25.25 — fixed in 4.25.25
TP-Link Systems Inc. Omada Guard: before 1.1.28 — fixed in 1.1.28
TP-Link Tapo: before 3.14.111 — fixed in 3.14.111
TP-Link Tether: before 4.12.27 — fixed in 4.12.27
TP-Link Tp-Partner: before 2.0.1 — fixed in 2.0.1
TP-Link Tpcamera: before 3.2.17 — fixed in 3.2.17
TP-Link Vigi: before 2.7.70 — fixed in 2.7.70
TP-Link Systems Inc. Wi-Fi Navi: before 1.5.5 — fixed in 1.5.5
TP-Link Systems Inc. WiFi Toolkit: before 1.4.28 — fixed in 1.4.28

How to fix

Upgrade to a fixed version: TP-Link Aginet 2.13.6; TP-Link Deco 3.9.163; TP-Link Festa 1.7.1; TP-Link Kasa 3.4.350; TP-Link Systems Inc. KidShield 1.1.21; TP-Link Omada 4.25.25; TP-Link Systems Inc. Omada Guard 1.1.28; TP-Link Tapo 3.14.111; TP-Link Tether 4.12.27; TP-Link Tp-Partner 2.0.1; TP-Link Tpcamera 3.2.17; TP-Link Vigi 2.7.70. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-9293 or the next vulnerability affects your stack