Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425
Priority MEDIUM 40CWE-306Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00371 31st percentileScored 2026-11-07
Fix Fixed Tapo C200 (TP-Link Systems Inc.): V3_1.4.5 Build 251104, V5_1.4.6 Build 260709 Rel.27675nTapo C100 v5 (TP Link Systems Inc.): V5_1.4.4 Build 260303+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| TP-Link | Tapo C200 | before V3_1.4.5 Build 251104; before V5_1.4.6 Build 260709 Rel.27675n | V3_1.4.5 Build 251104, V5_1.4.6 Build 260709 Rel.27675n | Patch available | CNA |
| TP-Link | Tapo C100 v5 | before V5_1.4.4 Build 260303 | V5_1.4.4 Build 260303 | Patch available | CNA |
| TP-Link | Tapo C425 v1.2 | before V1.20_1.2.27 Build 260518 | V1.20_1.2.27 Build 260518 | Patch available | CNA |
- Tapo C200 VendorTP-Link Affected before V3_1.4.5 Build 251104; before V5_1.4.6 Build 260709 Rel.27675n Fixed in V3_1.4.5 Build 251104, V5_1.4.6 Build 260709 Rel.27675n Patch available CNA
- Tapo C100 v5 VendorTP-Link Affected before V5_1.4.4 Build 260303 Fixed in V5_1.4.4 Build 260303 Patch available CNA
- Tapo C425 v1.2 VendorTP-Link Affected before V1.20_1.2.27 Build 260518 Fixed in V1.20_1.2.27 Build 260518 Patch available CNA
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.3:build_230228:*:*:*:*:*:* | 1.3.3 build_230228 | Vulnerable | TP-Link |
| cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.4:build_230424:*:*:*:*:*:* | 1.3.4 build_230424 | Vulnerable | TP-Link |
| cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.5:build_230717:*:*:*:*:*:* | 1.3.5 build_230717 | Vulnerable | TP-Link |
| cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.7:build_230920:*:*:*:*:*:* | 1.3.7 build_230920 | Vulnerable | TP-Link |
| cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.9:build_231019:*:*:*:*:*:* | 1.3.9 build_231019 | Vulnerable | TP-Link |
| cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.11:build_231115:*:*:*:*:*:* | 1.3.11 build_231115 | Vulnerable | TP-Link |
| cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.13:build_240327:*:*:*:*:*:* | 1.3.13 build_240327 | Vulnerable | TP-Link |
| cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.14:build_240513:*:*:*:*:*:* | 1.3.14 build_240513 | Vulnerable | TP-Link |
| cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.15:build_240715:*:*:*:*:*:* | 1.3.15 build_240715 | Vulnerable | TP-Link |
| cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.1:build_241212:*:*:*:*:*:* | 1.4.1 build_241212 | Vulnerable | TP-Link |
- cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.3:build_230228:*:*:*:*:*:* Versions 1.3.3 build_230228 Vulnerable ·TP-Link
- cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.4:build_230424:*:*:*:*:*:* Versions 1.3.4 build_230424 Vulnerable ·TP-Link
- cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.5:build_230717:*:*:*:*:*:* Versions 1.3.5 build_230717 Vulnerable ·TP-Link
- cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.7:build_230920:*:*:*:*:*:* Versions 1.3.7 build_230920 Vulnerable ·TP-Link
- cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.9:build_231019:*:*:*:*:*:* Versions 1.3.9 build_231019 Vulnerable ·TP-Link
- cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.11:build_231115:*:*:*:*:*:* Versions 1.3.11 build_231115 Vulnerable ·TP-Link
- cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.13:build_240327:*:*:*:*:*:* Versions 1.3.13 build_240327 Vulnerable ·TP-Link
- cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.14:build_240513:*:*:*:*:*:* Versions 1.3.14 build_240513 Vulnerable ·TP-Link
- cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.15:build_240715:*:*:*:*:*:* Versions 1.3.15 build_240715 Vulnerable ·TP-Link
- cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.1:build_241212:*:*:*:*:*:* Versions 1.4.1 build_241212 Vulnerable ·TP-Link
Show 3 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.2:build_250313:*:*:*:*:*:* | 1.4.2 build_250313 | Vulnerable | TP-Link |
| cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.4:build_250922:*:*:*:*:*:* | 1.4.4 build_250922 | Vulnerable | TP-Link |
| cpe:2.3:h:tp-link:tapo_c200:3:*:*:*:*:*:*:* | 3 | Running on | TP-Link |
- cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.2:build_250313:*:*:*:*:*:* Versions 1.4.2 build_250313 Vulnerable ·TP-Link
- cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.4:build_250922:*:*:*:*:*:* Versions 1.4.4 build_250922 Vulnerable ·TP-Link
- cpe:2.3:h:tp-link:tapo_c200:3:*:*:*:*:*:*:* Versions 3 Running on ·TP-Link
Remediation
- Fix · CNA Tapo C200 (TP-Link Systems Inc.) Fixed in V3_1.4.5 Build 251104, V5_1.4.6 Build 260709 Rel.27675n
- Fix · CNA Tapo C100 v5 (TP Link Systems Inc.) Fixed in V5_1.4.4 Build 260303
- Fix · CNA Tapo C425 v1.2 (TP Link Systems Inc.) Fixed in V1.20_1.2.27 Build 260518
Timeline
- 2026-10-02 Threatist record created from CVE-2025-14300
- 2026-10-03 Alias added: GHSA-38mv-4mrh-vpwc
References
Patch 8
- https://www.tp-link.com/us/support/download/tapo-c200/v3/#Firmware-Release-Notes
- https://www.tp-link.com/en/support/download/tapo-c100/v5/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/download/tapo-c100/v5/#Firmware-Release-Notes
- https://www.tp-link.com/en/support/download/tapo-c200/v3/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/download/tapo-c425/v1.20/#Firmware-Release-Notes
- https://www.tp-link.com/en/support/download/tapo-c425/v1.20/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes
- https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes
More TP-Link Tapo C200 Firmware vulnerabilities
- TI-2021-02932 TP-LINK Tapo C200 remote code execution vulnerability CVSS 3.1CRITICAL 9.8
- TI-2023-27043 Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware… CVSS 3.1MEDIUM 4.6
- TI-2023-11937 The AES Key-IV pair used by the TP-Link TAPO C200 camera V3 (EU) on firmware version… CVSS 3.1MEDIUM 4.6
- TI-2026-12889 Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200 CVSS 4.0HIGH 8.7
- TI-2025-07378 Remote Code Execution via Stack-based Buffer Overflow in ONVIF SOAP Parser in TP-Link Tapo C200 and C520WS CVSS 4.0HIGH 8.7
- TI-2026-12890 Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200 CVSS 4.0HIGH 7.1
Sources
- CVE-2025-14300 · CVE Program
- CVE-2025-14300 · NVD
- FIRST EPSS
- GHSA-38mv-4mrh-vpwc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences