CVE-2025-14300
Published: 20 December 2025
Description
The HTTPS service on Tapo C200 V3 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS).
Mitigating Controls (NIST 800-53 r5)AI
AC-14 directly identifies and restricts sensitive functions like the connectAP interface permitted without authentication, preventing unauthorized Wi-Fi configuration modifications by local attackers.
AC-3 enforces approved authorizations for access to system resources such as the HTTPS service endpoints, blocking unauthenticated requests that modify device configuration.
AC-6 enforces least privilege, ensuring unauthenticated entities on the local network cannot access or alter Wi-Fi settings via the exposed interface.
Security SummaryAI
CVE-2025-14300 is a missing authentication vulnerability (CWE-306) in the HTTPS service on the TP-Link Tapo C200 V3 camera. The service exposes a connectAP interface without proper authentication checks, allowing unauthorized access to sensitive device configuration endpoints. This flaw has a CVSS v3.1 base score of 8.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), indicating high severity due to its potential for integrity and availability impacts with low complexity and no privileges required.
An unauthenticated attacker on the same local network segment can exploit this vulnerability by sending crafted requests to the exposed interface. Successful exploitation enables modification of the device's Wi-Fi configuration, leading to loss of connectivity and a denial-of-service (DoS) condition on the affected camera.
TP-Link has addressed this issue through firmware updates available on their support download pages for the Tapo C200 V3 and related models such as Tapo C100 V5, including release notes at the provided URLs. Additional mitigation guidance is detailed in their support FAQ 4849.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication in HTTPS service enables exploitation of remote service (T1210) for unauthorized configuration changes, specifically Wi-Fi settings, resulting in endpoint DoS via application exploitation (T1499.004).