Medium severity · published Dec 20, 2025
CVE-2025-14299
Improper Content-Length Validation in HTTPS Requests on Tapo C200
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on the same local network segment can send crafted HTTPS requests to trigger excessive memory allocation, causing the device to crash and resulting in denial-of-service (DoS).
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TC
Tapo C200 V3 · TP-Link Systems Inc.
before C200(US)_V3_1.4.5 Build 251104 · source: vendor
TC
Tapo C200 Firmware · Tp-link
1.3.3; 1.3.4; 1.3.5; 1.3.7; 1.3.9; 1.3.11; +6 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-14299
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-14299
Release Notes
https://www.tp-link.com/us/support/download/tapo-c200/v3/#Firmware-Release-Notes
Vendor Advisory
https://www.tp-link.com/us/support/faq/4849/
More from Tapo C200 V3
6.5
CVE-2026-12760
Denial-of-Service Vulnerability via Malformed IPv4 Fragmentation Handling in TP-Link Tapo C200
6.5
CVE-2025-8065
Remote Code Execution via Stack-based Buffer Overflow in ONVIF SOAP Parser in TP-Link Tapo C200 and C520WS