CVE-2025-14300: TP-Link Tapo c200 Firmware

High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days.

The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5  exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS).

Affected products

• TP-Link Tapo c200 Firmware: version 1.3.3 only; version 1.3.4 only; version 1.3.5 only; version 1.3.7 only; version 1.3.9 only; version 1.3.11 only; …

Published 2025-12-20. Last modified 2026-09-30.