Unauthenticated Access in Tapo C200 HTTPS Causes DoS

Publication date: 2025-12-20

Last updated on: 2026-04-03

Assigner: TPLink

Description

The HTTPS service on Tapo C200 V3 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-20

Last Modified

2026-04-03

Generated

2026-07-06

AI Q&A

2025-12-20

EPSS Evaluated

2026-07-05

NVD

CVE-2025-14300

Affected Vendors & Products

Vendor	Product	Version / Range
tapo	c200	v3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

The vulnerability exists in the HTTPS service of the Tapo C200 V3 device, where the connectAP interface is exposed without proper authentication. This allows an attacker on the same local network to access this interface without credentials and modify the device's Wi-Fi settings.

Impact Analysis

An attacker exploiting this vulnerability can change the Wi-Fi configuration of the device, which can cause loss of connectivity and result in a denial-of-service (DoS) condition, disrupting normal device operation.

Hi! I’m here to help you understand CVE-2025-14300. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70