Read the docs
TI-2025-07378 Aliases CVE-2025-8065GHSA-5r97-vg42-wrjj

Remote Code Execution via Stack-based Buffer Overflow in ONVIF SOAP Parser in TP-Link Tapo C200 and C520WS

Priority LOW 38CWE-121Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

A stack-based buffer overflow vulnerability was identified in the ONVIF SOAP XML Parser in Tapo C200 v3 and C520WS v2.6. When processing XML tags with namespace prefixes, the parser fails to validate the prefix length before copying it to a fixed-size stack buffer. It allowed a crafted SOAP request with an oversized namespace prefix to cause memory corruption in stack. An unauthenticated attacker on the same local network may exploit this flaw to enable remote code execution with elevated privileges, leading to full compromise of the device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0053 45th percentileScored 2026-11-07
Fix Fixed Tapo C200 V3 (TP-Link Systems Inc.): V3_1.4.5 Build 251104Tapo C520WS v2.6 (TP-Link Systems Inc.): 1.2.4 Build 260326 Rel.24666n

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkTapo C200 V3before V3_1.4.5 Build 251104V3_1.4.5 Build 251104Patch availableCNA
TP-LinkTapo C520WS v2.6before 1.2.4 Build 260326 Rel.24666n1.2.4 Build 260326 Rel.24666nPatch availableCNA
  • Tapo C200 V3 VendorTP-Link Affected before V3_1.4.5 Build 251104 Fixed in V3_1.4.5 Build 251104 Patch available CNA
  • Tapo C520WS v2.6 VendorTP-Link Affected before 1.2.4 Build 260326 Rel.24666n Fixed in 1.2.4 Build 260326 Rel.24666n Patch available CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.3:build_230228:*:*:*:*:*:*1.3.3 build_230228VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.4:build_230424:*:*:*:*:*:*1.3.4 build_230424VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.5:build_230717:*:*:*:*:*:*1.3.5 build_230717VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.7:build_230920:*:*:*:*:*:*1.3.7 build_230920VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.9:build_231019:*:*:*:*:*:*1.3.9 build_231019VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.11:build_231115:*:*:*:*:*:*1.3.11 build_231115VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.13:build_240327:*:*:*:*:*:*1.3.13 build_240327VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.14:build_240513:*:*:*:*:*:*1.3.14 build_240513VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.15:build_240715:*:*:*:*:*:*1.3.15 build_240715VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.1:build_241212:*:*:*:*:*:*1.4.1 build_241212VulnerableTP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.3:build_230228:*:*:*:*:*:* Versions 1.3.3 build_230228 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.4:build_230424:*:*:*:*:*:* Versions 1.3.4 build_230424 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.5:build_230717:*:*:*:*:*:* Versions 1.3.5 build_230717 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.7:build_230920:*:*:*:*:*:* Versions 1.3.7 build_230920 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.9:build_231019:*:*:*:*:*:* Versions 1.3.9 build_231019 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.11:build_231115:*:*:*:*:*:* Versions 1.3.11 build_231115 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.13:build_240327:*:*:*:*:*:* Versions 1.3.13 build_240327 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.14:build_240513:*:*:*:*:*:* Versions 1.3.14 build_240513 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.15:build_240715:*:*:*:*:*:* Versions 1.3.15 build_240715 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.1:build_241212:*:*:*:*:*:* Versions 1.4.1 build_241212 Vulnerable ·TP-Link
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.2:build_250313:*:*:*:*:*:*1.4.2 build_250313VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.4:build_250922:*:*:*:*:*:*1.4.4 build_250922VulnerableTP-Link
cpe:2.3:h:tp-link:tapo_c200:3:*:*:*:*:*:*:*3Running onTP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.2:build_250313:*:*:*:*:*:* Versions 1.4.2 build_250313 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.4:build_250922:*:*:*:*:*:* Versions 1.4.4 build_250922 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:tapo_c200:3:*:*:*:*:*:*:* Versions 3 Running on ·TP-Link

Remediation

  • Fix · CNA Tapo C200 V3 (TP-Link Systems Inc.) Fixed in V3_1.4.5 Build 251104
  • Fix · CNA Tapo C520WS v2.6 (TP-Link Systems Inc.) Fixed in 1.2.4 Build 260326 Rel.24666n

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-8065
  2. 2026-10-03 Alias added: GHSA-5r97-vg42-wrjj

References

Patch 4

Advisory 1

  • TI-2021-02932 TP-LINK Tapo C200 remote code execution vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-27043 Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware… CVSS 3.1MEDIUM 4.6
  • TI-2023-11937 The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version… CVSS 3.1MEDIUM 4.6
  • TI-2026-12889 Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200 CVSS 4.0HIGH 8.7
  • TI-2025-13063 Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425 CVSS 4.0HIGH 8.7
  • TI-2026-12890 Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200 CVSS 4.0HIGH 7.1
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences