EUVD-2026-18432
GHSA-wfj8-p8xg-8j7g
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 was identified, due to inconsistent parsing and authorization logic in JSON requests during authentication check. An unauthenticated attacker can append an authentication-exempt action to a request containing privileged DS do actions, bypassing authorization checks.
Successful exploitation allows unauthenticated execution of restricted configuration actions, which may result in unauthorized modification of device state.
AnalysisAI
TP-Link Tapo C520WS v2.6 contains an authentication bypass in its HTTP-based DS configuration service that allows unauthenticated attackers to execute privileged device configuration actions by appending authentication-exempt parameters to requests. The vulnerability stems from inconsistent JSON request parsing and authorization logic, enabling unauthorized modification of device state without requiring valid credentials. No public exploit code has been identified at time of analysis, and a vendor-released patch is available.
Technical ContextAI
The vulnerability exists in the HTTP request handling logic of the DS configuration service within the TP-Link Tapo C520WS camera. The root cause is classified under CWE-287 (Improper Authentication), specifically resulting from inconsistent parsing of JSON-formatted HTTP requests combined with flawed authorization checks. The service fails to properly validate authentication status when processing requests that combine authentication-exempt actions with privileged DS (device state/configuration) operations. By manipulating the JSON structure or appending permitted actions to restricted requests, the parsing and authorization validation logic treats the combined request as authorized, bypassing the authentication requirement that should apply to privileged operations. This is a logic flaw rather than a cryptographic weakness-the authentication mechanism exists but is incorrectly applied to mixed-action requests.
RemediationAI
TP-Link has released a patched firmware version addressing this authentication bypass. Users should immediately download and install the latest firmware for the Tapo C520WS from the TP-Link support page (https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes or the regional equivalent at https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes). Detailed remediation and technical information is available in TP-Link's FAQ entry at https://www.tp-link.com/us/support/faq/5047/. As an interim measure on internet-exposed devices, network segmentation and firewall rules restricting HTTP access to the camera's configuration interface to trusted networks only should be implemented. However, firmware patching is the primary and recommended fix.
Directory traversal vulnerability in TP-LINK Archer C5 (1.2) with firmware before 150317, C7 (2.0) with firmware before
cgi-bin/admin/servetest in TP-Link IP Cameras TL-SC3130, TL-SC3130G, TL-SC3171, TL-SC3171G, and possibly other models be
The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to r
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_set
Stack-based buffer overflow in the run_init_sbus function in the KCodes NetUSB module for the Linux kernel, as used in c
Directory traversal vulnerability in the web-based management feature on the TP-LINK TL-WR841N router with firmware 3.13
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_sta
TP-Link Archer C7 and TL-WR841N routers contain an authenticated remote command execution vulnerability in the Parental
A vulnerability in the TP-Link Archer c20 router with firmware version V6.6_230412 and earlier permits unauthorized indi
Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated
TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a remote code execution (RCE) vulnerability via the functio
In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today