Tapo C520WS CVE-2026-6239

Three concrete prerequisites must all be satisfied: (1) Adjacent network access - the attacker must be on the same LAN or network segment as the camera (AV:A); internet-based exploitation is not possible without a prior foothold on the local network. (2) High-privilege authentication - the CVSS vector specifies PR:H, meaning the attacker must authenticate to the camera with administrator-level credentials before issuing the ONVIF CreateUsers request; unauthenticated exploitation is not possible. (3) ONVIF service enabled and reachable - the ONVIF management service must be running and accessible on the device, which is standard for this camera model but can be disabled. Limiting factors that reduce realistic risk: the adjacent-only vector eliminates all internet-sourced attacks; the admin credential requirement means an attacker without prior access to camera management cannot weaponize this vulnerability; and the impact is confined to a DoS of the ONVIF service only - no code execution, data exfiltration, or persistent device compromise has been described.

The CVSS 4.0 score of 6.8 reflects a meaningful but constrained risk profile. The vector AV:A/AC:L/AT:N/PR:H/UI:N breaks down as follows: attack vector is adjacent (LAN segment only - not internet-reachable without prior foothold), complexity is low, and no additional attack requirements exist, but high privileges (PR:H) are mandatory, meaning the attacker must already hold administrator-level credentials on the camera. The impact is limited entirely to availability (VA:H) with zero confidentiality or integrity impact (VC:N/VI:N). No EPSS score was provided in available intelligence, so exploitation probability cannot be quantified. The absence of a KEV listing and no identified public POC further suggests this is not currently being exploited at scale. Real-world risk is low-to-moderate: the combination of adjacent-only access and required admin credentials substantially narrows the realistic attacker population to insiders, compromised LAN actors, or those who have separately acquired admin credentials. The primary operational risk is service disruption to ONVIF-dependent NVR/VMS integrations rather than data breach or device takeover.

An attacker who has obtained administrator-level credentials to the Tapo C520WS v2 - whether through credential reuse, phishing, or a prior network compromise - connects from the same LAN segment and sends a crafted ONVIF CreateUsers SOAP request containing hundreds of XML user node entries. The camera's ONVIF service processes the malformed request without validating the node count, overflows a fixed-size stack buffer, and the process crashes, taking down ONVIF management functions until the device is rebooted or the service restarts. No public exploit code has been identified at time of analysis.