The Tapo Cloud MQTT proxy accepts a host value that is user‑controlled and lacks input validation, yielding a server‑side request forgery vulnerability. Exploitation allows an attacker to coerce the proxy to send outbound requests to arbitrary destinations, potentially leaking sensitive internal data or enabling a distributed denial‑of‑service attack. This weakness is identified as CWE‑918.

Affected system is TP‑Link Systems Inc.’s Tapo Cloud Service. No specific version information is disclosed, so all deployments of the Tapo Cloud Service may be vulnerable until mitigated.

The CVSS score of 8.3 indicates a high‑severity vulnerability. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, yet the inherent ability to trigger outbound traffic from a cloud service represents a considerable threat. An attacker who can send crafted requests to the proxy can direct traffic to internal resources or external servers, provided the proxy retains network connectivity to those targets. Successful exploitation can lead to data exposure and potential denial‑of‑service impacts.