GHSA-38mv-4mrh-vpwcHighCVSS 8.1
The HTTPS service on Tapo C200 V3 exposes a connectAP interface without proper authentication. An...
🔗 CVE IDs covered (1)
📋 Description
The HTTPS service on Tapo C200 V3 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS).
🔗 References (11)
- https://nvd.nist.gov/vuln/detail/CVE-2025-14300
- https://www.tp-link.com/us/support/download/tapo-c200/v3/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/faq/4849
- https://www.tp-link.com/en/support/download/tapo-c100/v5/#Firmware-Release-Notes
- https://www.tp-link.com/en/support/download/tapo-c200/v3/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/download/tapo-c100/v5/#Firmware-Release-Notes
- https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes
- https://www.tp-link.com/en/support/download/tapo-c425/v1.20/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes
- https://www.tp-link.com/us/support/download/tapo-c425/v1.20/#Firmware-Release-Notes
- https://github.com/advisories/GHSA-38mv-4mrh-vpwc