8.1

CVE-2025-14300

Medienbericht

Unauthenticated Access to connectAP API Endpoint on Tapo C100 and C200

The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5  exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tp-link ≫ Tapo C200 Firmware Version 1.3.3 Update build_230228
   Tp-link ≫ Tapo C200 Version 3
Tp-link ≫ Tapo C200 Firmware Version 1.3.4 Update build_230424
   Tp-link ≫ Tapo C200 Version 3
Tp-link ≫ Tapo C200 Firmware Version 1.3.5 Update build_230717
   Tp-link ≫ Tapo C200 Version 3
Tp-link ≫ Tapo C200 Firmware Version 1.3.7 Update build_230920
   Tp-link ≫ Tapo C200 Version 3
Tp-link ≫ Tapo C200 Firmware Version 1.3.9 Update build_231019
   Tp-link ≫ Tapo C200 Version 3
Tp-link ≫ Tapo C200 Firmware Version 1.3.11 Update build_231115
   Tp-link ≫ Tapo C200 Version 3
Tp-link ≫ Tapo C200 Firmware Version 1.3.13 Update build_240327
   Tp-link ≫ Tapo C200 Version 3
Tp-link ≫ Tapo C200 Firmware Version 1.3.14 Update build_240513
   Tp-link ≫ Tapo C200 Version 3
Tp-link ≫ Tapo C200 Firmware Version 1.3.15 Update build_240715
   Tp-link ≫ Tapo C200 Version 3
Tp-link ≫ Tapo C200 Firmware Version 1.4.1 Update build_241212
   Tp-link ≫ Tapo C200 Version 3
Tp-link ≫ Tapo C200 Firmware Version 1.4.2 Update build_250313
   Tp-link ≫ Tapo C200 Version 3
Tp-link ≫ Tapo C200 Firmware Version 1.4.4 Update build_250922
   Tp-link ≫ Tapo C200 Version 3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.37% 0.304
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.1 2.8 5.2
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
f23511db-6c3e-4e32-a477-6aa17d310630 8.7 0 0
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
22.12.2025 10:34
https://www.tp-link.com/us/support/faq/4849/
Vendor Advisory
https://www.tp-link.com/en/support/download/tapo-c200/v5/#Firmware-Release-Notes
https://www.tp-link.com/us/support/download/tapo-c200/v5/#Firmware-Release-Notes
https://www.tp-link.com/en/support/download/tapo-c100/v5/#Firmware-Release-Notes
https://www.tp-link.com/en/support/download/tapo-c200/v3/#Firmware-Release-Notes
https://www.tp-link.com/en/support/download/tapo-c425/v1.20/#Firmware-Release-Notes
https://www.tp-link.com/us/support/download/tapo-c100/v5/#Firmware-Release-Notes
https://www.tp-link.com/us/support/download/tapo-c200/v3/#Firmware-Release-Notes
Release Notes
https://www.tp-link.com/us/support/download/tapo-c425/v1.20/#Firmware-Release-Notes