Auth bypass in TP-Link Systems Inc. Tapo App

CVE-2025-4975

When a notification relating to low battery appears for a user with whom the device has been shared, tapping the notification grants full access to the power settings of that device.

Vulnerability class: Broken Access Control

EPSS: 0.001 (2.7th percentile) — read the EPSS interpretation.