CVE-2025-14553 - CVE House
Back to Database
Status published High CVE-2025-14553

Password Hash Leak Could Lead to Unauthorized Access on Tapo App via Local Network

Vulnerability Description

Exposure of password hashes through an unauthenticated API response in TP-Link Tapo app on iOS and Android for Tapo cameras, allowing attackers to brute force the password in the local network. Issue can be mitigated through mobile application updates. Device firmware remains unchanged.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-14553

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Juraj Nyíri

References

More from TP-Link Systems Inc.

View All →
CVE-2025-9961
Authenticated RCE by CWMP binary
High 8.6
CVE-2025-9522
Blind Server-Side Request Forgery (SSRF) in Omada Controller
Medium 5.1
CVE-2025-9521
Password Confirmation Bypass in Omada Controller
Low 2.1
CVE-2025-9520
IDOR Leading to Owner Account Hijacking in Omada Controller
High 8.3
CVE-2025-9377
Authenticated RCE via Parental Control command injection
High 8.6

Affected Vendor

TP-Link Systems Inc.

View all reports →

Affected Software

TP-Link Tapo App
Vulnerable Versions:
0

Timeline

Official Publish: December 16th, 2025
Last Modified: January 9th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-200

MITRE ATT&CK TTPs

T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1041 Exfiltration Over C2 Channel
Exfiltration