8.7

CVE-2025-14300

Medienbericht

Unauthenticated Access to connectAP API Endpoint on Tapo C100 and C200

The HTTPS service on Tapo C200 V3 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Tp-link ≫ Tapo C200 Firmware Version1.3.3 Updatebuild_230228
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.3.4 Updatebuild_230424
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.3.5 Updatebuild_230717
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.3.7 Updatebuild_230920
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.3.9 Updatebuild_231019
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.3.11 Updatebuild_231115
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.3.13 Updatebuild_240327
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.3.14 Updatebuild_240513
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.3.15 Updatebuild_240715
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.4.1 Updatebuild_241212
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.4.2 Updatebuild_250313
   Tp-link ≫ Tapo C200 Version3
Tp-link ≫ Tapo C200 Firmware Version1.4.4 Updatebuild_250922
   Tp-link ≫ Tapo C200 Version3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.11% 0.288
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.1 2.8 5.2
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
f23511db-6c3e-4e32-a477-6aa17d310630 8.7 0 0
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.