Read the docs
TI-2025-13062 Aliases CVE-2025-14299GHSA-7cw2-wjj4-46p6

Improper Content-Length Validation in HTTPS Requests on Tapo C200

Priority LOW 31CWE-770Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on the same local network segment can send crafted HTTPS requests to trigger excessive memory allocation, causing the device to crash and resulting in denial-of-service (DoS).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00244 15th percentileScored 2026-11-07
Fix Fixed Tapo C200 V3 (TP-Link Systems Inc.): C200(US)_V3_1.4.5 Build 251104

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkTapo C200 V3before C200(US)_V3_1.4.5 Build 251104C200(US)_V3_1.4.5 Build 251104Patch availableCNA
  • Tapo C200 V3 VendorTP-Link Affected before C200(US)_V3_1.4.5 Build 251104 Fixed in C200(US)_V3_1.4.5 Build 251104 Patch available CNA

CPE configurations NVD · 13

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.3:build_230228:*:*:*:*:*:*1.3.3 build_230228VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.4:build_230424:*:*:*:*:*:*1.3.4 build_230424VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.5:build_230717:*:*:*:*:*:*1.3.5 build_230717VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.7:build_230920:*:*:*:*:*:*1.3.7 build_230920VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.9:build_231019:*:*:*:*:*:*1.3.9 build_231019VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.11:build_231115:*:*:*:*:*:*1.3.11 build_231115VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.13:build_240327:*:*:*:*:*:*1.3.13 build_240327VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.14:build_240513:*:*:*:*:*:*1.3.14 build_240513VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.15:build_240715:*:*:*:*:*:*1.3.15 build_240715VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.1:build_241212:*:*:*:*:*:*1.4.1 build_241212VulnerableTP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.3:build_230228:*:*:*:*:*:* Versions 1.3.3 build_230228 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.4:build_230424:*:*:*:*:*:* Versions 1.3.4 build_230424 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.5:build_230717:*:*:*:*:*:* Versions 1.3.5 build_230717 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.7:build_230920:*:*:*:*:*:* Versions 1.3.7 build_230920 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.9:build_231019:*:*:*:*:*:* Versions 1.3.9 build_231019 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.11:build_231115:*:*:*:*:*:* Versions 1.3.11 build_231115 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.13:build_240327:*:*:*:*:*:* Versions 1.3.13 build_240327 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.14:build_240513:*:*:*:*:*:* Versions 1.3.14 build_240513 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.15:build_240715:*:*:*:*:*:* Versions 1.3.15 build_240715 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.1:build_241212:*:*:*:*:*:* Versions 1.4.1 build_241212 Vulnerable ·TP-Link
Show 3 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.2:build_250313:*:*:*:*:*:*1.4.2 build_250313VulnerableTP-Link
cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.4:build_250922:*:*:*:*:*:*1.4.4 build_250922VulnerableTP-Link
cpe:2.3:h:tp-link:tapo_c200:3:*:*:*:*:*:*:*3Running onTP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.2:build_250313:*:*:*:*:*:* Versions 1.4.2 build_250313 Vulnerable ·TP-Link
  • cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.4:build_250922:*:*:*:*:*:* Versions 1.4.4 build_250922 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:tapo_c200:3:*:*:*:*:*:*:* Versions 3 Running on ·TP-Link

Remediation

  • Fix · CNA Tapo C200 V3 (TP-Link Systems Inc.) Fixed in C200(US)_V3_1.4.5 Build 251104

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-14299
  2. 2026-10-03 Alias added: GHSA-7cw2-wjj4-46p6

References

Advisory 1

Other 1

  • TI-2021-02932 TP-LINK Tapo C200 remote code execution vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-27043 Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware… CVSS 3.1MEDIUM 4.6
  • TI-2023-11937 The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version… CVSS 3.1MEDIUM 4.6
  • TI-2026-12889 Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200 CVSS 4.0HIGH 8.7
  • TI-2025-13063 Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425 CVSS 4.0HIGH 8.7
  • TI-2025-07378 Remote Code Execution via Stack-based Buffer Overflow in ONVIF SOAP Parser in TP-Link Tapo C200 and C520WS CVSS 4.0HIGH 8.7
See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences