TP-Link

Records637All Threatist records

Exploited (KEV)6In CISA KEV

CVSS critical100CVSS 9.0–10.0

CVSS high356CVSS 7.0–8.9

Exploited now

TP-Link records in CISA KEV

TI-2023-27456 TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability CRITICAL 86KEV 2025-09-03 TI-2025-08589 TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability CRITICAL 96KEV 2025-09-03 TI-2020-14907 TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability CRITICAL 97KEV 2025-09-02 TI-2023-16571 TP-Link Multiple Routers Command Injection Vulnerability CRITICAL 97KEV 2025-06-16 TI-2023-01313 TP-Link Archer AX-21 Command Injection Vulnerability CRITICAL 97KEV 2023-05-01 TI-2015-02672 TP-Link Multiple Archer Devices Directory Traversal Vulnerability CRITICAL 90KEV 2022-03-25

Components

Products in the NVD configurations · select one to filter the records

Tl-wr841n Firmware 39 records CRITICAL Tl-wr886n Firmware 39 records MEDIUM Er5110g Firmware 25 records LOW Er5120g Firmware 25 records LOW Er5510g Firmware 25 records LOW Er5520g Firmware 25 records LOW R4149g Firmware 25 records LOW R4239g Firmware 25 records LOW

Records

8 records in Tapo · all components

TI-2023-11922 CVE-2023-27098 · GHSA-5cjr-mrq7-q7wq

TP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel.

HIGH 66

TP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00379 Published 2024-01-09 No fix listed CWE-312

TI-2023-17400 CVE-2023-34829 · GHSA-rqjq-h72m-vgr3

Incorrect access control in TP-Link Tapo before v3.1.315 allows attackers to access user credentials in plaintext.

MEDIUM 62

Incorrect access control in TP-Link Tapo before v3.1.315 allows attackers to access user credentials in plaintext.

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00249 Published 2023-12-28 No fix listed CWE-319

TI-2025-08518 CVE-2025-9293 · GHSA-h573-p6v2-3p2p

Insufficient Certificate Validation in Multiple Mobile Applications Allows Man in the Middle Interception

LOW 35

A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00245 Published 2026-02-13 Fixed in 3.14.111, 3.4.350 +12 CWE-295

TI-2023-20173 CVE-2023-38907 · GHSA-pp6v-57ch-47rf

An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630…

LOW 35

An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to replay old messages encrypted with a still va…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00962 Published 2023-09-25 No fix listed

TI-2023-20175 CVE-2023-38909 · GHSA-22hp-9244-wch3

An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630…

LOW 30

An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive information via the IV compo…

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00797 Published 2023-08-22 No fix listed

TI-2023-20174 CVE-2023-38908 · GHSA-5r7p-fhx2-h2pf

An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630…

LOW 30

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00542 Published 2023-08-22 No fix listed

TI-2023-20172 CVE-2023-38906 · GHSA-vqj5-w55h-74wr

An issue in TPLink Smart Bulb Tapo series L530 1.1.9, L510E 1.0.8, L630 1.0.3, P100…

LOW 29

An issue in TPLink Smart Bulb Tapo series L530 1.1.9, L510E 1.0.8, L630 1.0.3, P100 1.4.9, Smart Camera Tapo series C200 1.1.18, and Tapo Application 2.8.14 allows a remote attacker to obtain sensitive information via th…

CVSS 3.1MEDIUM 6.5 Adjacent network No auth No interaction EPSS 0.00511 Published 2023-08-21 No fix listed

TI-2025-08517 CVE-2025-9292 · GHSA-mgx6-7qx4-g5f3

Permissive Web Security Policy Allows Cross-Origin Access Control Bypass on Omada Cloud Controllers

LOW 11

A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances.

CVSS 4.0LOW 2.0 Network High privileges User interaction EPSS 0.00388 Published 2026-02-13 No fix listed CWE-942

Open these records in search →