CVE-2025-14299: Improper Content-Length Validation in HTTPS Requests on Tapo C200

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-20 · updated 2026-06-17
Weakness: CWE-770

Description

The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on the same local network segment can send crafted HTTPS requests to trigger excessive memory allocation, causing the device to crash and resulting in denial-of-service (DoS).

Affected products

TP-Link Systems Inc. Tapo C200 v5: 1.3.3-build_230228, 1.3.4-build_230424, 1.3.5-build_230717, 1.3.7-build_230920, 1.3.9-build_231019, 1.3.11-build_231115 (+6)

References

https://www.tp-link.com/us/support/download/tapo-c200/v3/#Firmware-Release-Notes
https://www.tp-link.com/us/support/faq/4849/

Get alerted when CVE-2025-14299 or the next vulnerability affects your stack