CVEvulnerability

CVE-2025-9293

7.7 HIGH Published 2026-02-13 Modified 2026-06-17 Official page ↗
Status
Analyzed
Published
2026-02-13
Last modified
2026-06-17
Assigner
f23511db-6c3e-4e32-a477-6aa17d310630
CVSS 4.0 (f23511db-6c3e-4e32-a477-6aa17d310630)
7.7 HIGH — CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-295

Description

A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication. An attacker in a privileged network position may be able to intercept or modify traffic if they can position themselves within the communication channel. Successful exploitation may compromise confidentiality, integrity, and availability of application data.

Affected configurations

• tp-link aginet (< 2.13.6) • tp-link deco (< 3.9.163) • tp-link festa (< 1.7.1) • tp-link kasa (< 3.4.350) • tp-link kidshield (< 1.1.21) • tp-link omada (< 4.25.25) • tp-link omada guard (< 1.1.28) • tp-link tapo (< 3.14.111) • tp-link tether (< 4.12.27) • tp-link tp-partner (< 2.0.1) • tp-link tpcamera (< 3.2.17) • tp-link vigi (< 2.7.70) • tp-link wi-fi navi (< 1.5.5) • tp-link wifi toolkit (< 1.4.28)

Related

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References