EUVD-2026-18426Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (TPLink) · only source for this CVE.
CVSS VectorVendor: TPLink
Lifecycle Timeline
4DescriptionCVE.org
A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 in the HTTP POST body parsing logic due to missing validation of remaining buffer capacity after dynamic allocation, due to insufficient boundary validation when handling externally supplied HTTP input. An attacker on the same network segment could trigger heap memory corruption conditions by sending crafted payloads that cause write operations beyond allocated buffer boundaries. Successful exploitation causes a Denial-of-Service (DoS) condition, causing the device’s process to crash or become unresponsive.
AnalysisAI
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows remote attackers on the same network segment to trigger denial-of-service by sending crafted HTTP POST payloads that exceed allocated buffer boundaries. The vulnerability stems from missing validation in HTTP body parsing logic, causing process crashes or unresponsiveness. No CVSS score or vector data is available, limiting precise severity quantification, but the practical attack vector is network-adjacent and does not require authentication.
Technical ContextAI
The vulnerability is a classic heap-based buffer overflow (CWE-122) occurring in HTTP POST body parsing logic. The affected component dynamically allocates memory for request handling but fails to validate remaining buffer capacity before write operations, allowing externally supplied HTTP input to overflow heap boundaries. TP-Link Tapo C520WS is an IP camera device running firmware v2.6; the vulnerable code path is invoked during HTTP request processing on the device's web interface. The CPE identifier cpe:2.3:a:tp-link_systems_inc.:tapo_c520ws_v2.6:*:*:*:*:*:*:*:* confirms the specific product line and version affected. Heap overflow conditions result in memory corruption that can be reliably triggered by an attacker controlling the size and content of HTTP POST payloads.
RemediationAI
Vendor-released patch: Firmware update available from TP-Link. Users should immediately download and install the latest firmware version for the Tapo C520WS from the official support portal at https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes (US) or https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes (International). Detailed patching instructions and FAQ guidance are available at https://www.tp-link.com/us/support/faq/5047/. Until patching is complete, restrict network access to the camera's HTTP management interface using firewall rules or network segmentation to limit exposure to potential local network attackers.
More in Tapo C520Ws V2 6
View allTP-Link Tapo C520WS v2.6 contains an authentication bypass in its HTTP-based DS configuration service that allows unauth
Denial-of-service vulnerability in TP-Link Tapo C520WS v2.6 camera allows adjacent network attackers to trigger buffer o
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows local network attackers to cause denial of service by send
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows unauthenticated network attackers to trigger denial-of-ser
Stack-based buffer overflow in TP-Link Tapo C520WS v2.6 allows remote attackers to trigger denial-of-service by sending
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today