Tapo C520Ws V2 6 CVE-2026-34119

Attacker must be on the same network segment as TP-Link Tapo C520WS v2.6. No authentication required. Attacker sends crafted HTTP payloads with malformed segmented request bodies to trigger heap buffer overflow in HTTP parsing loop, causing DoS.

While CVSS vector data is unavailable, the attack profile indicates moderate-to-high real-world risk for affected deployments. The attack vector is network-based and requires only network proximity (same segment), with no authentication required based on the description. The impact is limited to denial-of-service (process crash/hang) rather than code execution, which reduces severity compared to RCE-capable overflows. However, the combination of unauthenticated network access, low attack complexity (sending HTTP payloads), and reliable crash conditions makes this a practical DoS weapon against unpatched cameras in shared network environments (offices, retail locations, surveillance systems). The absence of EPSS and CVSS data prevents quantitative exploitation probability assessment, but the straightforward HTTP parsing attack surface and lack of authentication barriers suggest this could be relatively easy to exploit by an attacker with network access. The fact that a patch is already available suggests the vendor assessed this as a legitimate security concern warranting a fix release.

An attacker on the same local network segment (e.g., office WiFi, compromised router) crafts a malicious HTTP request with a deliberately oversized or improperly formatted multi-part body. The attacker sends this payload to the Tapo C520WS HTTP server, triggering the vulnerable parsing loop to write beyond the heap buffer's boundaries. The heap corruption causes the camera process to crash or hang, rendering it unresponsive and breaking video feeds or management capabilities until the device is manually rebooted. No public exploit code is referenced in available intelligence, but the straightforward nature of HTTP buffer overflow attacks suggests proof-of-concept development is likely feasible for researchers with firmware analysis capabilities.