CVE-2025-14300 — Unauthenticated Access to connectAP API Endpoint on Tapo C100, C200 & C425
The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network …
Published: 2025-12-20 · CVSS: 8.7 · CVSS 4.0
The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the same local network segment can exploit this to modify the device’s Wi-Fi configuration, resulting in loss of connectivity and denial-of-service (DoS).
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7