7.1

CVE-2025-14299

Medienbericht
The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on the same local network segment can send crafted HTTPS requests to trigger excessive memory allocation, causing the device to crash and resulting in denial-of-service (DoS).
Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tp-link ≫ Tapo C200 Firmware Version1.3.3 Updatebuild_230228
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.3.4 Updatebuild_230424
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.3.5 Updatebuild_230717
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.3.7 Updatebuild_230920
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.3.9 Updatebuild_231019
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.3.11 Updatebuild_231115
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.3.13 Updatebuild_240327
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.3.14 Updatebuild_240513
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.3.15 Updatebuild_240715
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.4.1 Updatebuild_241212
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.4.2 Updatebuild_250313
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.4.4 Updatebuild_250922
   Tp-link ≫ Tapo C200 Version3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.06% 0.188
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
f23511db-6c3e-4e32-a477-6aa17d310630 7.1 0 0
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-190 Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

CWE-770 Allocation of Resources Without Limits or Throttling

The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.