Tapo C200 Firmware CVE-2025-8065

Real-world risk is moderate to high for deployed devices but exploitation complexity contains the threat. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H) with attack vector limited to adjacent networks (AV:A), low attack complexity (AC:L), and no privileges required (PR:N). The adjacent network requirement means attackers must have local network access-either physical presence, compromised network credentials, or pivot from another compromised device-significantly reducing the attack surface compared to internet-exposed vulnerabilities. However, the lack of authentication requirements (PR:N) means any adjacent attacker can exploit without credentials once network access is achieved. No public exploit identified at time of analysis, and SSVC framework considerations show this affects consumer IoT devices where automated exploitation would have limited scope (single LAN segment). The primary risk scenarios involve targeted attacks against specific networks (corporate espionage, residential surveillance manipulation) or worm-like propagation within already-compromised networks. Compared to internet-facing RCE vulnerabilities, the adjacent-network constraint and consumer device context lower real-world urgency, though the complete device compromise and potential for persistent surveillance access elevate concern for privacy-sensitive deployments.

An attacker who has gained access to the local network-either through compromised WiFi credentials, physical proximity to an unsecured wireless network, or lateral movement from another compromised device-identifies Tapo C200 or C520WS cameras via network scanning on ONVIF service ports (typically TCP 80/443/8000). The attacker crafts a malicious SOAP request containing an XML namespace prefix exceeding the parser's stack buffer size and sends it to the camera's ONVIF endpoint without requiring authentication. The oversized prefix triggers the buffer overflow during XML parsing, overwriting stack memory with attacker-controlled data including shellcode. Successful exploitation grants code execution with elevated privileges in the camera's firmware context, allowing the attacker to disable recording, manipulate video feeds, extract stored footage, establish persistent backdoor access, or pivot to attack other network-connected devices. No public exploit identified at time of analysis, though the detailed vulnerability description provides sufficient technical information for skilled attackers to develop working exploits.