CVE-2025-14553CWE-200

Password Hash Leak Could Lead to Unauthorized Access on Tapo App via Local Network

High · published December 16, 2025

CVSS v4.0
7.0
EPSS
0%
Percentile
8.6
In the wild
Unconfirmed
What it is

Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force the password in the local network. Issue can be mitigated through mobile application updates. Device firmware remains unchanged.

The record
Technical detail
CVSS v4.0
7.0 · HIGH
Vector
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00194 · 8.6th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2025-12-16T18:38Z
EPSS history
Timeline
  • 16 DEC 18:38Z
    Password Hash Leak Could Lead to Unauthorized Access on Tapo App via Local Network
    cvelistv5