Medium severity · published Dec 20, 2025
CVE-2025-14299
The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on the same local network segment can send crafted HTTPS requests to trigger excessive memory allocation, causing the device to crash and resulting in denial-of-service (DoS).
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TC
Tapo C200 Firmware · Tp-link
1.3.3; 1.3.4; 1.3.5; 1.3.7; 1.3.9; 1.3.11; +6 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14299
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14299
Release Notes
https://www.tp-link.com/us/support/download/tapo-c200/v3/#Firmware-Release-Notes
Vendor Advisory
https://www.tp-link.com/us/support/faq/4849/
More from Tapo C200 Firmware
9.8
CVE-2021-4045
TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root
8.8
CVE-2026-15315
Unauthenticated Administrative Authentication Bypass via device_confirm Replay in TP-Link Tapo C120 and C200
8.1
CVE-2025-14300
Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425
6.5
CVE-2026-15316
Denial-of-Service via Oversized Encrypted Credential Input in TP-Link Tapo C200
6.5
CVE-2026-12760
Denial-of-Service Vulnerability via Malformed IPv4 Fragmentation Handling in TP-Link Tapo C200