Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425
The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS).
CVE-2025-14300
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-14300
Tapo C200
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Tapo C100 v5
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Tapo C425 v1.2
Source reference: /containers/cna/affected/2/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "TP-Link Systems Inc.",
"modules": [
"ONVIF Server"
],
"product": "Tapo C200",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V3_1.4.5 Build 251104",
"versionType": "custom"
},
{
"status": "affected",
"version": "0",
"lessThan": "V5_1.4.6 Build 260709 Rel.27675n",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "TP Link Systems Inc.",
"product": "Tapo C100 v5",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V5_1.4.4 Build 260303",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "TP Link Systems Inc.",
"product": "Tapo C425 v1.2",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "V1.20_1.2.27 Build 260518",
"versionType": "custom"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2025-14300
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #4959 · Revision 1
- Added to Heist Feed
- Publisher date