The vulnerability consists of an unauthenticated HTTPS endpoint named connectAP on the Tapo C100, C200 (v3, v5), and C425 (v1.2) devices. Without proper authentication, an attacker on the same local network can invoke the API to change the device’s Wi‑Fi configuration, causing loss of connectivity and a denial‑of‑service for the device's smart‑home functions. The flaw is identified as CWE‑306, a missing authentication weakness.

Affected devices are TP‑Link Tapo C100 v5, TP‑Link Tapo C200 (v3, v5), and TP‑Link Tapo C425 v1.2. Additional firmware versions may be impacted, but the report does not list specific firmware revisions beyond the product model and nominal release. No explicit vulnerable firmware build numbers are supplied.

The CVSS score of 8.7 places the weakness in the high range, and the EPSS score of less than 1% indicates that the likelihood of exploitation is low at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no known exploited instances. The attack vector is inferred to be local‑network based, as the exploit requires the attacker to be on the same LAN segment as the device. Once the endpoint is accessed, the attacker can modify Wi‑Fi settings and render the device unreachable, causing an outage for any services that rely on it.