Vulnerability · Published Dec 20, 2025 · Assigned by TPLink

CVE-2025-14300Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425

High 8.7

In plain English

A high-severity missing authentication in Tapo C100 v5 from TP Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 68.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS).

Affected products (as reported)

Vendor	Product	Versions
TP-Link Systems Inc.	Tapo C200	0 – before V3_1.4.5 Build 2511040 – before V5_1.4.6 Build 260709 Rel.27675n
TP Link Systems Inc.	Tapo C100 v5	0 – before V5_1.4.4 Build 260303
TP Link Systems Inc.	Tapo C425 v1.2	0 – before V1.20_1.2.27 Build 260518

Weakness: CWE-306 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

In plain English

Official description

Affected products (as reported)

References