CVE-2025-9293 | THREATINT

Description

A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication. An attacker in a privileged network position may be able to intercept or modify traffic if they can position themselves within the communication channel. Successful exploitation may compromise confidentiality, integrity, and availability of application data.

PUBLISHED Reserved 2025-08-20 | Published 2026-02-13 | Updated 2026-02-13 | Assigner TPLink

HIGH: 7.7CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:N/SA:N

Problem types

CWE-295 Improper Certificate Validation

Product status

Default status

unaffected

Any version before 3.14.111

affected

Default status

unaffected

Any version before 3.4.350

affected

Default status

unaffected

Any version before 4.25.25

affected

Default status

unaffected

Any version before 1.1.28

affected

Default status

unaffected

Any version before 4.12.27

affected

Default status

unaffected

Any version before 3.9.163

affected

Default status

unaffected

Any version before 2.13.6

affected

Default status

unaffected

Any version before 3.2.17

affected

Default status

unaffected

Any version before 1.4.28

affected

Default status

unaffected

Any version before 1.7.1

affected

Default status

unaffected

Any version before 1.5.5

affected

Default status

unaffected

Any version before 1.1.21

affected

Default status

unaffected

Any version before 2.0.1

affected

Default status

unaffected

Any version before 2.7.70

affected

Credits

Francesco La Spina, Stanislav Dashevskyi from Forescout Technologies finder

References

www.tp-link.com/us/support/faq/4969/ vendor-advisory

cve.org (CVE-2025-9293)

nvd.nist.gov (CVE-2025-9293)

Download JSON