Insufficient Certificate Validation in Multiple Mobile Applications Allows Man in the Middle Interception

Summary

A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communication. An attacker in a privileged network position may be able to intercept or modify traffic if they can position themselves within the communication channel. Successful exploitation may compromise confidentiality, integrity, and availability of application data.

Timeline

1. Feb 13, 2026, 12:22 AM UTCCVE published
2. Feb 13, 2026, 1:16 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Feb 13, 2026, 10:10 PM UTCRecord last updated

Affected versions

• TP-Link Systems Inc. Tapo App

  fixed in 3.14.111

• TP-Link Systems Inc. Kasa App

  fixed in 3.4.350

• TP Link Systems Inc. Omada App

  fixed in 4.25.25

• TP-Link Systems Inc. Omada Guard

  fixed in 1.1.28

• TP-Link Systems Inc. Tether App

  fixed in 4.12.27

• TP-Link Systems Inc. Deco App

  fixed in 3.9.163

• TP-Link Systems Inc. Aginet App

  fixed in 2.13.6

• TP-Link Systems Inc. tpCamera App

  fixed in 3.2.17

• TP-Link Systems Inc. WiFi Toolkit

  fixed in 1.4.28

• TP-Link Systems Inc. Festa App

  fixed in 1.7.1

• TP-Link Systems Inc. Wi-Fi Navi

  fixed in 1.5.5

• TP-Link Systems Inc. KidShield

  fixed in 1.1.21

• TP-Link Systems Inc. TP-Partner App

  fixed in 2.0.1

• TP-Link Systems Inc. VIGI App

  fixed in 2.7.70

References 2