Is there a patch available for EUVD-2026-18436?

Yes, a patch is available for EUVD-2026-18436. Update the affected software to the latest version immediately.

TP-Link EUVD-2026-18436

Q: What is the CVSS score of EUVD-2026-18436?

EUVD-2026-18436 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-34124 HIGH

Classic Buffer Overflow (CWE-120)

2026-04-02 TPLink

GHSA-9mqg-m9h5-3xhj

TP-Link Buffer Overflow

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 02, 2026 - 17:30 euvd

EUVD-2026-18436

Analysis Generated

Apr 02, 2026 - 17:30 vuln.today

Patch released

Apr 02, 2026 - 17:30 nvd

Patch available

CVE Published

Apr 02, 2026 - 17:20 nvd

HIGH 7.1

DescriptionCVE.org

A denial-of-service vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP request path parsing logic. The implementation enforces length restrictions on the raw request path but does not account for path expansion performed during normalization. An attacker on the adjacent network may send a crafted HTTP request to cause buffer overflow and memory corruption, leading to system interruption or device reboot.

AnalysisAI

Denial-of-service vulnerability in TP-Link Tapo C520WS v2.6 camera allows adjacent network attackers to trigger buffer overflow through crafted HTTP requests with excessively long paths that bypass initial length validation during path normalization, resulting in memory corruption and device reboot without requiring authentication. Vendor has released a patch; no public exploit code identified at time of analysis.

Technical ContextAI

The vulnerability exists in HTTP request path parsing logic where the application enforces length restrictions on the raw request path but fails to account for path expansion that occurs during normalization (e.g., resolution of relative path segments like '..' or URL encoding). This is a classic implementation flaw in input validation order: the check occurs before transformation, allowing an attacker to craft a path that passes the initial length check but expands beyond buffer boundaries during normalization. CWE-120 (Buffer Copy without Checking Size of Input) indicates the root cause is lack of proper bounds checking on the destination buffer. The affected product is TP-Link Tapo C520WS version 2.6, a networked IP camera device (CPE: cpe:2.3:a:tp-link_systems_inc.:tapo_c520ws_v2.6:*:*:*:*:*:*:*:*), running embedded HTTP server firmware.

RemediationAI

Vendor-released patch available: upgrade TP-Link Tapo C520WS firmware from version 2.6 to the latest available version provided at https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes or https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes. The firmware release notes page contains the patched version number and download link. If firmware upgrade is not immediately possible, implement network segmentation to restrict HTTP access to the camera to trusted devices only; however, note that any device on the adjacent network may exploit this vulnerability, so network isolation is the primary interim control. For additional guidance, consult the vendor FAQ at https://www.tp-link.com/us/support/faq/5047/.