TP-Link Tapo C200 V3 HTTP Header Content-Length allocation of resources

Summaryinfo

A vulnerability marked as critical has been reported in TP-Link Tapo C200 V3. Affected is an unknown function of the component HTTP Header Handler. Performing a manipulation of the argument Content-Length results in allocation of resources. This vulnerability is reported as CVE-2025-14299. The attacker must have access to the local network to execute the attack. No exploit exists.

Detailsinfo

A vulnerability was found in TP-Link Tapo C200 V3 (the affected version is unknown). It has been classified as critical. This affects an unknown code of the component HTTP Header Handler. The manipulation of the argument Content-Length with an unknown input leads to a allocation of resources vulnerability. CWE is classifying the issue as CWE-770. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor. This is going to have an impact on availability. The summary by CVE is:

The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on the same local network segment can send crafted HTTPS requests to trigger excessive memory allocation, causing the device to crash and resulting in denial-of-service (DoS).

The weakness was disclosed by Simone Margaritelli. The advisory is shared at tp-link.com. This vulnerability is uniquely identified as CVE-2025-14299 since 12/08/2025. The exploitability is told to be easy. The attack needs to be initiated within the local network. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-204620). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• TP-Link

Name

• Tapo C200 V3

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion