CVE-2025-8065

tp-link tapo c200 firmware

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2025-8065

Katalog CVE

CVSS 6.5 · Medium EPSS 0,53%

Kerentanan Stack-based Buffer Overflow pada tp-link tapo c200 firmware. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

A stack-based buffer overflow vulnerability was identified in the ONVIF SOAP XML Parser in Tapo C200 v3 and C520WS v2.6. When processing XML tags with namespace prefixes, the parser fails to validate the prefix length before copying it to a fixed-size stack buffer. It allowed a crafted SOAP request with an oversized namespace prefix to cause memory corruption in stack. An unauthenticated attacker on the same local network may exploit this flaw to enable remote code execution with elevated privileges, leading to full compromise of the device.

Rincian

Terbit di NVD
20 Desember 2025
Terakhir diubah
25 September 2026
Status NVD
Modified
CVSS 3.1
6.5 (Medium), sumber NVD
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-121: Stack-based Buffer Overflow
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
EPSS (30 hari)
0,53% peluang dieksploitasi; lebih tinggi dari 43,2% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
tp-link tapo c200 firmware Versi 1.3.3 build_230228
tp-link tapo c200 firmware Versi 1.3.4 build_230424
tp-link tapo c200 firmware Versi 1.3.5 build_230717
tp-link tapo c200 firmware Versi 1.3.7 build_230920
tp-link tapo c200 firmware Versi 1.3.9 build_231019
tp-link tapo c200 firmware Versi 1.3.11 build_231115
tp-link tapo c200 firmware Versi 1.3.13 build_240327
tp-link tapo c200 firmware Versi 1.3.14 build_240513
tp-link tapo c200 firmware Versi 1.3.15 build_240715
tp-link tapo c200 firmware Versi 1.4.1 build_241212
tp-link tapo c200 firmware Versi 1.4.2 build_250313
tp-link tapo c200 firmware Versi 1.4.4 build_250922

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.