TP-Link Tapo H100 and P100 Improper Certificate Validation Vulnerability Allowing Man-in-the-Middle Attack

A vulnerability allowing improper certificate validation has been identified in the TP-Link Tapo H100 v1 and Tapo P100 v1. This vulnerability allows an on-path attacker on the same network segment to intercept and modify encrypted communications between the devices and the cloud. As a result, the confidentiality and integrity of the data exchanged can be compromised, potentially leading to unauthorized manipulation of device information or control.

Impact

Exploitation of this vulnerability could allow an attacker to intercept and alter encrypted communications between the affected devices and the cloud, leading to unauthorized changes in device data or operations.

Remediation

Users are advised to update to the latest firmware version. Instructions for downloading the updated firmware are available on the TP-Link support pages for both the Tapo H100 and Tapo P100.