CVE-2025-8065highCWE-121

CVE-2025-8065: high-severity vulnerability in TP-Link Systems Inc. Tapo C200 V3

Remote Code Execution via Stack-based Buffer Overflow in ONVIF SOAP Parser in TP-Link Tapo C200 and C520WS

Published · Updated

Follow this CVE+ Monitor Tapo C520WS+ Monitor Tapo C200

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.5%
A stack-based buffer overflow vulnerability was identified in the ONVIF SOAP XML Parser in Tapo C200 v3 and C520WS v2.6. When processing XML tags with namespace prefixes, the parser fails to validate the prefix length before copying it to a fixed-size stack buffer. It allowed a crafted SOAP request with an oversized namespace prefix to cause memory corruption in stack. An unauthenticated attacker on the same local network may exploit this flaw to enable remote code execution with elevated privileges, leading to full compromise of the device.
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
TP-Link Systems Inc. · Tapo C200 V3TP-Link Systems Inc. · Tapo C520WS v2.6
Related CVEs — TP-Link Systems Inc. Tapo C200 V3

In the same product, most dangerous first.

CVE-2026-34121HIGHAuthentication Bypass in DS Configuration Service via HTTP Request Parsing Differential of TP-Link Tapo C520WS and C210EPSS 0.5%CVE-2026-34118HIGHHeap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in multiple TP-Link Tapo CamerasEPSS 0.4%CVE-2026-34124HIGHDenial of Service via Path Expansion Overflow in HTTP Service in TP-Link Tapo C520WSEPSS 0.3%CVE-2026-34122HIGHStack-based Buffer Overflow Leading to Denial of Service in TP-Link Tapo C520WSEPSS 0.3%CVE-2025-14299HIGHImproper Content-Length Validation in HTTPS Requests on Tapo C200EPSS 0.2%CVE-2026-34120HIGHHeap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in TP-Link Tapo C520WSEPSS 0.2%