TP-Link Tapo App prior 3.10.513 Notification privileges management

Summaryinfo

A vulnerability labeled as critical has been found in TP-Link Tapo App. Affected by this vulnerability is an unknown functionality of the component Notification Handler. The manipulation results in privileges management. This vulnerability was named CVE-2025-4975. The attack needs to be approached locally. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in TP-Link Tapo App. Affected is an unknown part of the component Notification Handler. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

When a notification relating to low battery appears for a user with whom the device has been shared, tapping the notification grants full access to the power settings of that device.

The advisory is shared for download at tp-link.com. This vulnerability is traded as CVE-2025-4975 since 05/20/2025. The exploitability is told to be easy. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 3.10.513 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• TP-Link

Name

• Tapo App

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion