A stack-based buffer overflow vulnerability was identified in the ONVIF SOAP XML Parser in Tapo C200 v3 and C520WS v2.6. When processing XML tags with namespace prefixes, the parser fails to validate the prefix length before copying it to a fixed-size stack buffer. It allowed a crafted SOAP request with an oversized namespace prefix to cause memory corruption in stack.
An unauthenticated attacker on the same local network may exploit this flaw to enable remote code execution with elevated privileges, leading to full compromise of the device.
References
Configurations
Configuration 1 (hide)
| AND |
|
History
03 Apr 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Apr 2026, 18:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-121 | |
| Summary | (en) A stack-based buffer overflow vulnerability was identified in the ONVIF SOAP XML Parser in Tapo C200 v3 and C520WS v2.6. When processing XML tags with namespace prefixes, the parser fails to validate the prefix length before copying it to a fixed-size stack buffer. It allowed a crafted SOAP request with an oversized namespace prefix to cause memory corruption in stack. An unauthenticated attacker on the same local network may exploit this flaw to enable remote code execution with elevated privileges, leading to full compromise of the device. | |
| References |
|
08 Jan 2026, 19:38
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.5:build_230717:*:*:*:*:*:* cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.1:build_241212:*:*:*:*:*:* cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.15:build_240715:*:*:*:*:*:* cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.3:build_230228:*:*:*:*:*:* cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.2:build_250313:*:*:*:*:*:* cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.7:build_230920:*:*:*:*:*:* cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.13:build_240327:*:*:*:*:*:* cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.4:build_230424:*:*:*:*:*:* cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.14:build_240513:*:*:*:*:*:* cpe:2.3:h:tp-link:tapo_c200:3:*:*:*:*:*:*:* cpe:2.3:o:tp-link:tapo_c200_firmware:1.4.4:build_250922:*:*:*:*:*:* cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.9:build_231019:*:*:*:*:*:* cpe:2.3:o:tp-link:tapo_c200_firmware:1.3.11:build_231115:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
| References | () https://www.tp-link.com/us/support/download/tapo-c200/v3/#Firmware-Release-Notes - Release Notes | |
| References | () https://www.tp-link.com/us/support/faq/4849/ - Vendor Advisory | |
| CWE | CWE-120 | |
| First Time |
Tp-link
Tp-link tapo C200 Tp-link tapo C200 Firmware |
20 Dec 2025, 01:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-20 01:16
Updated : 2026-04-03 17:16
NVD link : CVE-2025-8065
Mitre link : CVE-2025-8065
CVE.ORG link : CVE-2025-8065
JSON object : View
Products Affected
tp-link
- tapo_c200_firmware
- tapo_c200