CVE-2025-14299 — Improper Content-Length Validation in HTTPS Requests on Tapo C200
The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on the same local netwo…
Published: 2025-12-20 · CVSS: 7.1 · CVSS 4.0
The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on the same local network segment can send crafted HTTPS requests to trigger excessive memory allocation, causing the device to crash and resulting in denial-of-service (DoS).
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7