← CVE Intelligence

CVE-2025-9293

Insufficient Certificate Validation in Multiple Mobile Applications Allows Man in the Middle Interception PUBLISHED

Description (CNA)

A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication. An attacker in a privileged network position may be able to intercept or modify traffic if they can position themselves within the communication channel. Successful exploitation may compromise confidentiality, integrity, and availability of application data.

Affected (CNA)

Vendor / productVersions
TP-Link Systems Inc. / Tapo Appaffected 0 before 3.14.111
TP-Link Systems Inc. / Kasa Appaffected 0 before 3.4.350
TP Link Systems Inc. / Omada Appaffected 0 before 4.25.25
TP-Link Systems Inc. / Omada Guardaffected 0 before 1.1.28
TP-Link Systems Inc. / Tether Appaffected 0 before 4.12.27
TP-Link Systems Inc. / Deco Appaffected 0 before 3.9.163
TP-Link Systems Inc. / Aginet Appaffected 0 before 2.13.6
TP-Link Systems Inc. / tpCamera Appaffected 0 before 3.2.17
TP-Link Systems Inc. / WiFi Toolkitaffected 0 before 1.4.28
TP-Link Systems Inc. / Festa Appaffected 0 before 1.7.1
TP-Link Systems Inc. / Wi-Fi Naviaffected 0 before 1.5.5
TP-Link Systems Inc. / KidShieldaffected 0 before 1.1.21
TP-Link Systems Inc. / TP-Partner Appaffected 0 before 2.0.1
TP-Link Systems Inc. / VIGI Appaffected 0 before 2.7.70

CWE

CWE-295

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.