CVE-2025-14300CWE-306

CVE-2025-14300

High · published December 20, 2025

CVSS v3.1
8.1
EPSS
0%
Percentile
29.9
In the wild
Unconfirmed
What it is

🚨 An unauthenticated interface on Tapo C200 V3 could hand attackers the keys to your Wi-Fi network! Think of your Wi-Fi as a private party — the connectAP interface is like an open door that lets anyone walk in without an invitation. If someone can stroll right in and mess with the music (your Wi-Fi settings), they can throw the whole party into chaos! An attacker on the same local network can exploit this vulnerability to modify your device’s Wi-Fi configuration, potentially severing your connection and leading to a denial-of-service (DoS). That means no internet for you or anyone on that network — absolutely devastating in a world that thrives on connectivity!

Put simply

Think of your Wi-Fi as a private party — the connectAP interface is like an open door that lets anyone walk in without an invitation. If someone can stroll right in and mess with the music (your Wi-Fi settings), they can throw the whole party into chaos! The HTTPS service on the Tapo C200 V3 exposes a connectAP interface without proper authentication, allowing unauthenticated users to modify Wi-Fi settings.

What to do

An attacker on the same local network can exploit this vulnerability to modify your device’s Wi-Fi configuration, potentially severing your connection and leading to a denial-of-service (DoS). That means no internet for you or anyone on that network — absolutely devastating in a world that thrives on connectivity! To safeguard your network, update your Tapo C200 to the latest firmware version as soon as it's available. Additionally, limit access to your network and ensure that all devices are secured with strong passwords, especially those connected to IoT devices. You've got this! Follow these steps, and you'll secure your network in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00371 · 29.9th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-12-20T06:16Z
Affected products (12)
ProductVersionsFixed in
tp-link/tapo_c200_firmwareall versions—
tp-link/tapo_c200_firmwareall versions—
tp-link/tapo_c200_firmwareall versions—
tp-link/tapo_c200_firmwareall versions—
tp-link/tapo_c200_firmwareall versions—
tp-link/tapo_c200_firmwareall versions—
tp-link/tapo_c200_firmwareall versions—
tp-link/tapo_c200_firmwareall versions—
tp-link/tapo_c200_firmwareall versions—
tp-link/tapo_c200_firmwareall versions—
tp-link/tapo_c200_firmwareall versions—
tp-link/tapo_c200_firmwareall versions—
References (9)
EPSS history
Timeline
  • 20 DEC 00:43Z
    Unauthenticated Access to connectAP API Endpoint on Tapo C100 and C200
    cvelistv5