Improper Content-Length Validation in HTTPS Requests on Tapo C200

published 2025-12-20 10 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-204620

cvss: 6.5; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 15%
public exploits: 0; none known

The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on the same local network segment can send crafted HTTPS requests to trigger excessive memory allocation, causing the device to crash and resulting in denial-of-service (DoS).

Patch / fix

fixed in 1

TP-Link Systems Inc. Tapo C200 V3 C200(US)_V3_1.4.5 Build 251104

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 10 mo ago (2025-12-22)

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	7.1	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA	4.0	7.1	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	6.5	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

TP-Link Systems Inc. Tapo C200 V3

Classification

Weakness

CWE-770 Allocation of Resources Without Limits or Throttling
CWE-190 Integer Overflow or Wraparound

References

tp-link.com /us/support/faq/4849/
vendor-advisory
tp-link.com /us/support/download/tapo-c200/v3/#Firmware-Release-Notes
release-notes

Sources

CVE List CVE-2025-14299
NVD CVE-2025-14299

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary