CVE-2025-14299

tp-link tapo c200 firmware

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2025-14299

Katalog CVE

CVSS 6.5 · Medium EPSS 0,24%

Kerentanan Allocation of Resources Without Limits or Throttling pada tp-link tapo c200 firmware. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on the same local network segment can send crafted HTTPS requests to trigger excessive memory allocation, causing the device to crash and resulting in denial-of-service (DoS).

Rincian

Terbit di NVD
20 Desember 2025
Terakhir diubah
17 Juni 2026
Status NVD
Analyzed
CVSS 3.1
6.5 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-190: Integer Overflow or Wraparound
EPSS (30 hari)
0,24% peluang dieksploitasi; lebih tinggi dari 14,4% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
tp-link tapo c200 firmware Versi 1.3.3 build_230228
tp-link tapo c200 firmware Versi 1.3.4 build_230424
tp-link tapo c200 firmware Versi 1.3.5 build_230717
tp-link tapo c200 firmware Versi 1.3.7 build_230920
tp-link tapo c200 firmware Versi 1.3.9 build_231019
tp-link tapo c200 firmware Versi 1.3.11 build_231115
tp-link tapo c200 firmware Versi 1.3.13 build_240327
tp-link tapo c200 firmware Versi 1.3.14 build_240513
tp-link tapo c200 firmware Versi 1.3.15 build_240715
tp-link tapo c200 firmware Versi 1.4.1 build_241212
tp-link tapo c200 firmware Versi 1.4.2 build_250313
tp-link tapo c200 firmware Versi 1.4.4 build_250922

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.