Vulnerability · Published Dec 20, 2025 · Assigned by TPLink

CVE-2025-14299Improper Content-Length Validation in HTTPS Requests on Tapo C200

High 7.1

In plain English

A high-severity resource allocation without limits in Tapo C200 V3 from TP-Link Systems Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.2%top 84.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on the same local network segment can send crafted HTTPS requests to trigger excessive memory allocation, causing the device to crash and resulting in denial-of-service (DoS).

Affected products (as reported)

Vendor	Product	Versions
TP-Link Systems Inc.	Tapo C200 V3	0 – before C200(US)_V3_1.4.5 Build 251104

Weakness: CWE-770 · Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

In plain English

Official description

Affected products (as reported)

References