PT-2025-51777 · Tp Link · Tapo C210

Juraj Nyíri · CVE-2025-14553 · Published 2025-12-16 · Updated 2026-01-09

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions TP-Link Tapo C210 versions 1.8

Description An unauthenticated API response exposes password hashes in the TP-Link Tapo C210 application on iOS and Android. This allows attackers to attempt to brute force the password within the local network. The API endpoint responsible for this exposure is not specified. The vulnerable data includes password hashes, which are exposed through the API.

Recommendations Update the mobile application to mitigate the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2025-14553

Affected Products

Tapo C210

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14553 · Security Note
• https://twitter.com/CVEnew/status/2001350867069657204 · Twitter Post
• https://tp-link.com/us/support/faq/4840 · Note
• https://play.google.com/store/apps/details?id=com.tplink.iot · Note
• https://twitter.com/VulmonFeeds/status/2001178369203867878 · Twitter Post
• https://t.me/CVEtracker/39992 · Telegram Post
• https://apps.apple.com/us/app/tp-link-tapo/id1472718009 · Note
• https://t.me/cveNotify/148157 · Telegram Post