Tapo C520Ws V2 6 EUVD-2026-18436

TP-Link Tapo C520WS v2.6 device running default firmware. Attacker must be on the same adjacent network as the target device. Requires sending a crafted HTTP request with path normalization expansion to trigger buffer overflow. No authentication or user interaction required.

While CVSS score and vector are not provided, the vulnerability presents moderate real-world risk. Attack vector is adjacent network (not Internet-wide), which limits exposure compared to network-accessible vulnerabilities; however, devices on local networks are frequently accessible to compromised IoT peers or guest networks. The attack requires no authentication per the description (unauthenticated access to HTTP server), and complexity is low-crafting an oversized path is trivial. Impact is limited to denial of service (device reboot) rather than remote code execution or information disclosure, reducing severity. However, the combination of zero user interaction, trivial exploit crafting, and impact on device availability (IoT cameras are often relied upon for continuous recording) makes this operationally significant for affected deployments. Patch availability reduces urgency, but legacy or unmanaged Tapo C520WS v2.6 installations may remain vulnerable indefinitely. SSVC considerations: exploitation is straightforward, impact is system availability, technical impact is complete denial of service.

An attacker on the same local network as a TP-Link Tapo C520WS v2.6 camera (e.g., via compromised guest WiFi, neighboring IoT device, or direct LAN access) sends a malicious HTTP GET request with a crafted path containing relative segments or encoding that expands beyond the buffer limit during normalization-for example, a path with dozens of '../' sequences that initially appears under the length limit but expands during parsing. The unvalidated expansion triggers a buffer overflow in the HTTP parser, corrupting adjacent memory structures and causing the camera firmware to crash or reboot, interrupting surveillance service. No public proof-of-concept code has been identified, but the exploit is conceptually simple to construct once the path expansion bypass is understood.