CVE-2025-8065
EUVD-2025-20462120.12.2025, 01:16
A stack-based buffer overflow vulnerability was identified in the ONVIF SOAP XML Parser in Tapo C200 v3 and C520WS v2.6. When processing XML tags with namespace prefixes, the parser fails to validate the prefix length before copying it to a fixed-size stack buffer. It allowed a crafted SOAP request with an oversized namespace prefix to cause memory corruption in stack. An unauthenticated attacker on the same local network may exploit this flaw to enable remote code execution with elevated privileges, leading to full compromise of the device.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| tp-link | tapo_c200_firmware | 1.3.3:build_230228 |
| tp-link | tapo_c200_firmware | 1.3.4:build_230424 |
| tp-link | tapo_c200_firmware | 1.3.5:build_230717 |
| tp-link | tapo_c200_firmware | 1.3.7:build_230920 |
| tp-link | tapo_c200_firmware | 1.3.9:build_231019 |
| tp-link | tapo_c200_firmware | 1.3.11:build_231115 |
| tp-link | tapo_c200_firmware | 1.3.13:build_240327 |
| tp-link | tapo_c200_firmware | 1.3.14:build_240513 |
| tp-link | tapo_c200_firmware | 1.3.15:build_240715 |
| tp-link | tapo_c200_firmware | 1.4.1:build_241212 |
| tp-link | tapo_c200_firmware | 1.4.2:build_250313 |
| tp-link | tapo_c200_firmware | 1.4.4:build_250922 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-121 - Stack-based Buffer OverflowA stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
References