Tapo C200 Firmware CVE-2025-14300

Real-world risk is moderate-to-high for enterprise and shared network environments but requires nuanced evaluation beyond the 8.7 CVSS score. The attack vector limitation (AV:A - adjacent network) significantly constrains exploitation scope compared to remotely exploitable vulnerabilities, as attackers must already have Layer 2 network access via Wi-Fi association, physical LAN connection, or compromised network infrastructure. No public exploit code exists and CISA KEV does not list this CVE as actively exploited in the wild, reducing immediate widespread risk. However, the low attack complexity (AC:L), zero privilege requirements (PR:N), and lack of user interaction (UI:N) make exploitation trivial for adversaries with network proximity-a simple HTTP POST request suffices. The high confidentiality, integrity, and availability impacts (VC:H/VI:H/VA:H) reflect that successful exploitation enables complete device takeover: attackers can disconnect cameras from legitimate networks, force connection to rogue access points for man-in-the-middle attacks, or permanently brick devices by configuring invalid credentials. SSVC decision framework suggests elevated priority for organizations deploying Tapo cameras in business environments, hospitality networks, or multi-tenant buildings where adjacent network access is readily achievable by insiders, guests, or lateral-movement attackers. Consumer home networks face lower risk assuming WPA2/WPA3 perimeter security, though compromised guest networks or smart home botnets could weaponize this flaw for IoT-targeted DoS campaigns.

An attacker gains access to a corporate guest Wi-Fi network in an office building where Tapo C200 cameras monitor shared spaces like lobbies and conference rooms. Using network scanning tools, the attacker identifies camera IP addresses on the same subnet and sends unauthenticated HTTPS POST requests to the /connectAP endpoint with malicious Wi-Fi configuration payloads. The cameras immediately disconnect from the legitimate corporate SSID and attempt to associate with a non-existent or attacker-controlled access point, resulting in sustained loss of video surveillance coverage. Security teams discover the outage hours later during incident review, by which time the attacker has exfiltrated sensitive data from unmonitored areas or the cameras require manual factory reset and reconfiguration. No public exploit code exists at time of analysis, but the attack requires only basic HTTP client knowledge and network reconnaissance capabilities.