high8.1
CVE-2025-14300
The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication.
Impact
The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tp-Link | Tapo C200 Firmware | Versions 1.3.3, 1.3.4, 1.3.5, 1.3.7, 1.3.9, 1.3.11 |
Weakness classification
References
- NVD record
- CVE.org record
- https://www.tp-link.com/en/support/download/tapo-c100/v5/#Firmware-Release-Notes
- https://www.tp-link.com/en/support/download/tapo-c200/v3/#Firmware-Release-Notes
- https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes
- https://www.tp-link.com/en/support/download/tapo-c425/v1.20/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/download/tapo-c100/v5/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/download/tapo-c200/v3/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/download/tapo-c425/v1.20/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/faq/4849/