EUVD-2026-18432
GHSA-wfj8-p8xg-8j7g
Severity by source
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (TPLink) · only source for this CVE.
CVSS VectorVendor: TPLink
Lifecycle Timeline
4DescriptionCVE.org
An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 was identified, due to inconsistent parsing and authorization logic in JSON requests during authentication check. An unauthenticated attacker can append an authentication-exempt action to a request containing privileged DS do actions, bypassing authorization checks.
Successful exploitation allows unauthenticated execution of restricted configuration actions, which may result in unauthorized modification of device state.
AnalysisAI
TP-Link Tapo C520WS v2.6 contains an authentication bypass in its HTTP-based DS configuration service that allows unauthenticated attackers to execute privileged device configuration actions by appending authentication-exempt parameters to requests. The vulnerability stems from inconsistent JSON request parsing and authorization logic, enabling unauthorized modification of device state without requiring valid credentials. No public exploit code has been identified at time of analysis, and a vendor-released patch is available.
Technical ContextAI
The vulnerability exists in the HTTP request handling logic of the DS configuration service within the TP-Link Tapo C520WS camera. The root cause is classified under CWE-287 (Improper Authentication), specifically resulting from inconsistent parsing of JSON-formatted HTTP requests combined with flawed authorization checks. The service fails to properly validate authentication status when processing requests that combine authentication-exempt actions with privileged DS (device state/configuration) operations. By manipulating the JSON structure or appending permitted actions to restricted requests, the parsing and authorization validation logic treats the combined request as authorized, bypassing the authentication requirement that should apply to privileged operations. This is a logic flaw rather than a cryptographic weakness-the authentication mechanism exists but is incorrectly applied to mixed-action requests.
RemediationAI
TP-Link has released a patched firmware version addressing this authentication bypass. Users should immediately download and install the latest firmware for the Tapo C520WS from the TP-Link support page (https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes or the regional equivalent at https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes). Detailed remediation and technical information is available in TP-Link's FAQ entry at https://www.tp-link.com/us/support/faq/5047/. As an interim measure on internet-exposed devices, network segmentation and firewall rules restricting HTTP access to the camera's configuration interface to trusted networks only should be implemented. However, firmware patching is the primary and recommended fix.
More in Tapo C520Ws V2 6
View allDenial-of-service vulnerability in TP-Link Tapo C520WS v2.6 camera allows adjacent network attackers to trigger buffer o
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows local network attackers to cause denial of service by send
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows unauthenticated network attackers to trigger denial-of-ser
Heap-based buffer overflow in TP-Link Tapo C520WS v2.6 allows remote attackers on the same network segment to trigger de
Stack-based buffer overflow in TP-Link Tapo C520WS v2.6 allows remote attackers to trigger denial-of-service by sending
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today