CVE-2025-9293
Insufficient Certificate Validation in Multiple Mobile Applications Allows Man in the Middle Interception
- 7.7HighCVSS base score
- 0.24%Exploitation in 30 daysEPSS · top 85% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication. An attacker in a privileged network position may be able to intercept or modify traffic if they can position themselves within the communication channel. Successful exploitation may compromise confidentiality, integrity, and availability of application data.
Timeline
ID reserved
By TPLink
- 6 months later
· 6 months later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| TPLinkCNA (assigner) | 4.0 | High7.7 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N |
| NVDNVD · Analyzed | 4.0 | High7.7 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.24% · top 85% of all CVEs (10 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.7.
Affected products
TP-Link Systems Inc. · Tapo App
- affected < 3.14.111
TP-Link Systems Inc. · Kasa App
- affected < 3.4.350
TP Link Systems Inc. · Omada App
- affected < 4.25.25
TP-Link Systems Inc. · Omada Guard
- affected < 1.1.28
TP-Link Systems Inc. · Tether App
- affected < 4.12.27
TP-Link Systems Inc. · Deco App
- affected < 3.9.163
TP-Link Systems Inc. · Aginet App
- affected < 2.13.6
TP-Link Systems Inc. · tpCamera App
- affected < 3.2.17
TP-Link Systems Inc. · WiFi Toolkit
- affected < 1.4.28
TP-Link Systems Inc. · Festa App
- affected < 1.7.1
TP-Link Systems Inc. · Wi-Fi Navi
- affected < 1.5.5
TP-Link Systems Inc. · KidShield
- affected < 1.1.21
TP-Link Systems Inc. · TP-Partner App
- affected < 2.0.1
TP-Link Systems Inc. · VIGI App
- affected < 2.7.70
References
2
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-207522 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-9293)Record last updated .