CVE-2025-8065Remote Code Execution via Stack-based Buffer Overflow in ONVIF SOAP Parser in TP-Link Tapo C200 and C520WS
Updated under an hour ago ()
Does this affect you?
It affects TP-Link Systems Inc. Tapo C200 V3 and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
A stack-based buffer overflow vulnerability was identified in the ONVIF SOAP XML Parser in Tapo C200 v3 and C520WS v2.6. When processing XML tags with namespace prefixes, the parser fails to validate the prefix length before copying it to a fixed-size stack buffer. It allowed a crafted SOAP request with an oversized namespace prefix to cause memory corruption in stack. An unauthenticated attacker on the same local network may exploit this flaw to enable remote code execution with elevated privileges, leading to full compromise of the device.
- CVSS
- 8.7 HIGH (v4.0, CNA)CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Weakness (CWE)
- CWE-121
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- TPLink
- NVD analysis
- Modified
- Record last updated
- Apr 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
TP-Link Systems Inc. Tapo C200 V3 tp_link_systems:tapo_c200_v3 (from the name) | before V3_1.4.5 Build 251104 | CNA record |
TP-Link Systems Inc. Tapo C520WS v2.6 tp_link_systems:tapo_c520ws_v2.6 (from the name) | before 1.2.4 Build 260326 Rel.24666n | CNA record |
tp-link tapo_c200_firmware tp-link:tapo_c200_firmware | 1.3.3; 1.3.4; 1.3.5; 1.3.7; 1.3.9; 1.3.11; 1.3.13; 1.3.14; and 4 more ranges | NVD |
References
- https://www.tp-link.com/us/support/download/tapo-c200/v3/#Firmware-Release-Notespatch, release-notes
- https://www.tp-link.com/us/support/faq/4849/vendor-advisory
- https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notespatch
- https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notespatch
- https://www.tp-link.com/en/support/download/tapo-c200/v3/#Firmware-Release-Notespatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.