CVE-2025-9293
Insufficient Certificate Validation in Multiple Mobile Applications Allows Man in the Middle Interception
- State
- Published
- Severity
- 7.7 High
- Published
- Feb 13, 2026
- Updated
- Feb 13, 2026
- Reserved
- Aug 20, 2025
Description
A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication. An attacker in a privileged network position may be able to intercept or modify traffic if they can position themselves within the communication channel. Successful exploitation may compromise confidentiality, integrity, and availability of application data.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.7 High | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N | TPLink |
Weaknesses
- CWE-295 Improper Certificate Validation
Affected Products
| Product | Versions |
|---|---|
Tapo AppTP-Link Systems Inc. |
|
Kasa AppTP-Link Systems Inc. |
|
Omada AppTP Link Systems Inc. |
|
Omada GuardTP-Link Systems Inc. |
|
Tether AppTP-Link Systems Inc. |
|
Deco AppTP-Link Systems Inc. |
|
Aginet AppTP-Link Systems Inc. |
|
tpCamera AppTP-Link Systems Inc. |
|
WiFi ToolkitTP-Link Systems Inc. |
|
Festa AppTP-Link Systems Inc. |
|
Wi-Fi NaviTP-Link Systems Inc. |
|
KidShieldTP-Link Systems Inc. |
|
TP-Partner AppTP-Link Systems Inc. |
|
VIGI AppTP-Link Systems Inc. |
|
References
- https://www.tp-link.com/us/support/faq/4969/vendor-advisory
- https://www.omadanetworks.com/us/support/faq/4969/vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.