Skip to content
OpenAdvisories
High · 7.7 CVE-2025-9293 EUVD-2025-207522GHSA-h573-p6v2-3p2p

Insufficient Certificate Validation in Multiple Mobile Applications Allows Man in the Middle Interception

Published Feb 13, 2026 · Updated Feb 13, 2026 · Assigned by TPLink

Vendor: TP-Link Systems Product: Aginet App Product: Deco App Product: Festa App Product: Kasa App Product: KidShield Product: Omada App Product: Omada Guard Product: Tapo App Product: Tether App Product: TP-Partner App Product: tpCamera App Product: VIGI App Product: Wi-Fi Navi Product: WiFi Toolkit Category: Network devices

Description

A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication. An attacker in a privileged network position may be able to intercept or modify traffic if they can position themselves within the communication channel. Successful exploitation may compromise confidentiality, integrity, and availability of application data.

Affected products

VendorProductAffectedFixed
TP-Link Systems Tapo App < 3.14.111 3.14.111
TP-Link Systems Kasa App < 3.4.350 3.4.350
TP Link Systems Omada App < 4.25.25 4.25.25
TP-Link Systems Omada Guard < 1.1.28 1.1.28
TP-Link Systems Tether App < 4.12.27 4.12.27
TP-Link Systems Deco App < 3.9.163 3.9.163
TP-Link Systems Aginet App < 2.13.6 2.13.6
TP-Link Systems tpCamera App < 3.2.17 3.2.17
TP-Link Systems WiFi Toolkit < 1.4.28 1.4.28
TP-Link Systems Festa App < 1.7.1 1.7.1
TP-Link Systems Wi-Fi Navi < 1.5.5 1.5.5
TP-Link Systems KidShield < 1.1.21 1.1.21
TP-Link Systems TP-Partner App < 2.0.1 2.0.1
TP-Link Systems VIGI App < 2.7.70 2.7.70

References