CVE-2025-14300: Tp-link Tapo C200 Auth Bypass Vulnerability

CVE-2025-14300 Overview

CVE-2025-14300 affects the TP-Link Tapo C200 V3 security camera. The HTTPS service exposes a connectAP interface that does not require authentication. An attacker on the same local network segment can call this interface to modify the camera's Wi-Fi configuration. The result is loss of network connectivity and a denial-of-service (DoS) condition for the device. The flaw is tracked under CWE-306: Missing Authentication for Critical Function.

Critical Impact
An unauthenticated adjacent attacker can rewrite the Tapo C200 V3 Wi-Fi configuration through the exposed connectAP HTTPS endpoint, disconnecting the camera from the network and disabling video monitoring.

Affected Products

TP-Link Tapo C200 V3 hardware revision
TP-Link Tapo C200 firmware versions 1.3.3 through 1.4.4 (builds 230228 through 250922)
TP-Link Tapo C100 V5 (referenced in vendor firmware release notes)

Discovery Timeline

2025-12-20 - CVE-2025-14300 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14300

Vulnerability Analysis

The Tapo C200 V3 camera runs an HTTPS service on the local network. The service exposes a connectAP interface used to configure the Wi-Fi access point the camera connects to. The interface is reachable without any credentials or session token. An attacker who can reach the camera over the local network can issue arbitrary connectAP requests. This produces a high impact to confidentiality, integrity, and availability of the device's network state, but does not extend beyond the affected component.

Root Cause

The root cause is missing authentication on a critical configuration function [CWE-306]. The connectAP endpoint accepts and applies Wi-Fi configuration changes without verifying caller identity. Network configuration interfaces should require administrator authentication before processing changes. The endpoint instead trusts any client that can establish a TLS connection to the device on the local network.

Attack Vector

Exploitation requires adjacent network access — the attacker must be on the same Layer 2 segment as the camera, such as the home or office Wi-Fi network. The attacker sends a crafted HTTPS request to the camera's connectAP endpoint, supplying a new SSID and pre-shared key. The camera applies the new configuration and attempts to associate with the attacker-specified access point. If the new access point is unreachable or invalid, the camera loses connectivity and stops streaming.

No public proof-of-concept exploit code is available. The vulnerability is described in the TP-Link Tapo C200 Firmware Release Notes and TP-Link FAQ on Tapo.

Detection Methods for CVE-2025-14300

Indicators of Compromise

Tapo C200 cameras going offline unexpectedly or repeatedly disconnecting from the configured Wi-Fi SSID.
Unexpected changes to the SSID or Wi-Fi credentials stored in the Tapo mobile application for the C200 device.
HTTPS connections to the camera's local IP address originating from devices that are not the Tapo cloud service or the administrator's mobile client.

Detection Strategies

Monitor DHCP leases and ARP tables for the camera's MAC address to detect when the device drops off the network.
Inspect wireless controller logs for repeated association failures or roams initiated by the camera MAC address.
Capture HTTPS traffic to the camera on the local segment and flag any client other than the authorized administrator endpoints calling configuration paths.

Monitoring Recommendations

Place IoT devices including Tapo C200 cameras on a segmented VLAN with logging at the gateway.
Alert on loss of heartbeat or video stream from each registered camera for more than a defined threshold.
Track firmware version inventory across deployed Tapo C200 devices to identify units still running affected builds.

How to Mitigate CVE-2025-14300

Immediate Actions Required

Update affected Tapo C200 V3 cameras to the latest firmware version published by TP-Link as soon as a fixed build is available.
Isolate Tapo C200 cameras on a dedicated IoT VLAN that blocks lateral traffic from untrusted client devices.
Restrict who can join the Wi-Fi network hosting Tapo cameras and rotate the network pre-shared key.

Patch Information

TP-Link publishes firmware updates for the Tapo C200 V3 through its support portal. Refer to the TP-Link Tapo C200 V3 Firmware Release Notes and the TP-Link FAQ on Tapo for the current fixed build. Apply the update through the Tapo mobile application or the device's local update mechanism. Validate the installed firmware version after the update completes.

Workarounds

Block inbound HTTPS connections to the camera from all hosts except the Tapo cloud service and authorized mobile clients using firewall rules at the gateway or access point.
Disable local network access for guest devices and unknown clients on the same SSID as the Tapo C200.
Use wireless client isolation on the access point so that clients cannot reach the camera directly over Layer 2.

bash

# Example: iptables rule on a Linux-based router to restrict access
# to the Tapo C200 camera (replace 192.0.2.50 with the camera IP)
iptables -I FORWARD -d 192.0.2.50 -p tcp --dport 443 -j DROP
iptables -I FORWARD -s 192.0.2.10 -d 192.0.2.50 -p tcp --dport 443 -j ACCEPT