Buffer overflow in Tp-link Tapo_c200
CVE-2025-8065
A stack-based buffer overflow vulnerability was identified in the ONVIF SOAP XML Parser in Tapo C200 v3 and C520WS v2.6. When processing XML tags with namespace prefixes, the parser fails to validate the prefix length before copying it to…
Vulnerability class: Buffer Overflow
EPSS: 0.005 (39.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Tp-link Tapo_c200 — versions 3
- Tp-link Tapo_c200_firmware — versions 1.3.3, 1.3.4, 1.3.5
- Tp-link Systems Inc. Tapo C200 V3 — versions 0
- Tp-link Systems Inc. Tapo C520ws V2.6 — versions 0
Weakness classification (CWE)
References
- f23511db-6c3e-4e32-a477-6aa17d310630 (Release Notes, patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (vendor-advisory, Vendor Advisory)
- f23511db-6c3e-4e32-a477-6aa17d310630 (patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (patch)
- f23511db-6c3e-4e32-a477-6aa17d310630 (patch)
Frequently asked questions
- What is CVE-2025-8065?
- CVE-2025-8065 is a medium-severity vulnerability in Tp-link Tapo_c200, classified under Stack-based Buffer Overflow. CVSS score: 6.5/10. Published 2025-12-20.
- How severe is CVE-2025-8065?
- Medium severity. CVSS v3 base score is 6.5 out of 10.