Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2025-14300

Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in V3_1.4.5 Build 251104, V5_1.4.6 Build 260709 Rel.27675n, V5_1.4.4 Build 260303, V1.20_1.2.27 Build 260518
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5  exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS).

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • TP-Link Systems Inc. Tapo C200

    fixed in V3_1.4.5 Build 251104; fixed in V5_1.4.6 Build 260709 Rel.27675n

  • TP Link Systems Inc. Tapo C100 v5

    fixed in V5_1.4.4 Build 260303

  • TP Link Systems Inc. Tapo C425 v1.2

    fixed in V1.20_1.2.27 Build 260518

References 9

tp-link.com