EUVD-2026-18436
GHSA-9mqg-m9h5-3xhj
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (TPLink) · only source for this CVE.
CVSS VectorVendor: TPLink
Lifecycle Timeline
4DescriptionCVE.org
A denial-of-service vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP request path parsing logic. The implementation enforces length restrictions on the raw request path but does not account for path expansion performed during normalization. An attacker on the adjacent network may send a crafted HTTP request to cause buffer overflow and memory corruption, leading to system interruption or device reboot.
AnalysisAI
Denial-of-service vulnerability in TP-Link Tapo C520WS v2.6 camera allows adjacent network attackers to trigger buffer overflow through crafted HTTP requests with excessively long paths that bypass initial length validation during path normalization, resulting in memory corruption and device reboot without requiring authentication. Vendor has released a patch; no public exploit code identified at time of analysis.
Technical ContextAI
The vulnerability exists in HTTP request path parsing logic where the application enforces length restrictions on the raw request path but fails to account for path expansion that occurs during normalization (e.g., resolution of relative path segments like '..' or URL encoding). This is a classic implementation flaw in input validation order: the check occurs before transformation, allowing an attacker to craft a path that passes the initial length check but expands beyond buffer boundaries during normalization. CWE-120 (Buffer Copy without Checking Size of Input) indicates the root cause is lack of proper bounds checking on the destination buffer. The affected product is TP-Link Tapo C520WS version 2.6, a networked IP camera device (CPE: cpe:2.3:a:tp-link_systems_inc.:tapo_c520ws_v2.6:*:*:*:*:*:*:*:*), running embedded HTTP server firmware.
RemediationAI
Vendor-released patch available: upgrade TP-Link Tapo C520WS firmware from version 2.6 to the latest available version provided at https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes or https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes. The firmware release notes page contains the patched version number and download link. If firmware upgrade is not immediately possible, implement network segmentation to restrict HTTP access to the camera to trusted devices only; however, note that any device on the adjacent network may exploit this vulnerability, so network isolation is the primary interim control. For additional guidance, consult the vendor FAQ at https://www.tp-link.com/us/support/faq/5047/.
More in Tapo C520Ws V2 6
View allTP-Link Tapo C520WS v2.6 contains an authentication bypass in its HTTP-based DS configuration service that allows unauth
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows local network attackers to cause denial of service by send
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows unauthenticated network attackers to trigger denial-of-ser
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows remote attackers on the same network segment to trigger de
Stack-based buffer overflow in TP-Link Tapo C520WS v2.6 allows remote attackers to trigger denial-of-service by sending
Same weakness CWE-120 – Classic Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today