CVE-2025-8065
Unknown Unknown - Not Provided
Buffer Overflow in Tapo C200 V3 ONVIF Parser Causes DoS

Publication date: 2025-12-20

Last updated on: 2026-04-03

Assigner: TPLink

Description
A stack-based buffer overflow vulnerability was identified in the ONVIF SOAP XML Parser in Tapo C200 v3 and C520WS v2.6. When processing XML tags with namespace prefixes, the parser fails to validate the prefix length before copying it to a fixed-size stack buffer. It allowed a crafted SOAP request with an oversized namespace prefix to cause memory corruption in stack. An unauthenticated attacker on the same local network may exploit this flaw to enable remote code execution with elevated privileges, leading to full compromise of the device.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-20
Last Modified
2026-04-03
Generated
2026-05-07
AI Q&A
2025-12-20
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
tapo c200 4.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :

The impact of this vulnerability is that an attacker on the same local network can cause the Tapo C200 V3 device to crash by exploiting the buffer overflow, resulting in denial-of-service. This means the device will become unavailable or unresponsive, potentially disrupting surveillance or monitoring functions.


Can you explain this vulnerability to me?

This vulnerability is a buffer overflow in the ONVIF XML parser of the Tapo C200 V3 device. An attacker who is unauthenticated but on the same local network can send specially crafted SOAP XML requests that cause memory overflow, leading to the device crashing and resulting in a denial-of-service (DoS).


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart