CVE-2025-14299 HIGH

CVE-2025-14299: Improper Content-Length Validation in HTTPS Requests on Tapo C200

Vendor Tp-Link Systems Inc.
Product Tapo C200 V3
Weakness CWE-770 · Uncontrolled resource consumption
Published December 20, 2025
Last update December 22, 2025
View on NVD All CVEs

CVSS base score

7.1/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on the same local network segment can send crafted HTTPS requests to trigger excessive memory allocation, causing the device to crash and resulting in denial-of-service (DoS).

Key dates

02Disclosure timeline

December 20, 2025 CVE published
December 22, 2025 Record updated