Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 15

Export CSV
CVE-2026-34121

Authentication Bypass in DS Configuration Service via HTTP Request Parsing Differential of TP-Link Tapo C520WS and C210

An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 and C210 v3 was identified, due to inconsistent parsing and authorization logic in JSON requests during authentication check. An unauthenticated attacker can append an authentication-exempt action to a request containing privileged DS do actions, bypassing authorization checks. Successful exploitation allows unauthenticated execution of restricted configuration actions, which may result in unauthorized modification of device state.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C520ws Tapo C520ws Firmware Tapo C520ws V2
CVE-2026-34118

Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in multiple TP-Link Tapo Cameras

A heap-based buffer overflow vulnerability was identified in multiple TP-Link Tapo cameras in the HTTP POST body parsing logic due to missing validation of remaining buffer capacity after dynamic allocation, due to insufficient boundary validation when handling externally supplied HTTP input.   An attacker on the same network segment could trigger heap memory corruption conditions by sending crafted payloads that cause write operations beyond allocated buffer boundaries.  Successful exploitation causes a Denial-of-Service (DoS) condition, causing the device’s process to crash or become unresponsive.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C520ws Tapo C520ws Firmware Tapo C520ws V2
CVE-2026-6240

Authenticated Stack-based Buffer Overflow in ONVIF DeleteUsers Service on TP-Link Tapo C520WS

A stack-based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF DeleteUsers service, due to insufficient boundary checks when handling multiple user deletion parameters. An authenticated attacker can send a crafted malicious request containing an excessive number of identifiers to overflow stack memory. Successful exploitation may result in a service crash or deadlock, leading to DoS affecting device management and monitoring functionality.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C520ws V2
CVE-2026-6242

Authenticated Format String Vulnerability in ONVIF Subscribe Service on TP-Link Tapo C520WS

An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of externally supplied parameters within formatting functions. An attacker may inject crafted format strings into event subscription requests or notification generation path to disrupt normal service execution. Successful exploitation may cause the event notification service to terminate unexpectedly, resulting in the loss of real-time alarm functionality and disruption of event notifications.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C520ws V2
CVE-2026-6239

Authenticated Stack-based Buffer Overflow in ONVIF CreateUsers Service in TP-Link Tao C520WS

A stack‑based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF CreateUsers service, where the device fails to properly validate the number of XML user nodes during request processing. An authenticated attacker can send a specially crafted ONVIF request containing an excessive number of user entries to trigger memory corruption. Successful exploitation may cause the ONVIF management service to terminate unexpectedly, resulting in a denial‑of‑service (DoS) condition that disrupts device configuration and management functions.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C520ws V2
CVE-2026-34123

Whitelist Validation Bypass in TP-Link Tapo C520WS

On Tapo C520WS v2, restricted accounts (for example, hub users) are intended to execute only a limited set of low‑sensitivity operations. Due to a logic flaw in the device’s API authorization mechanism, an attacker can craft requests that leverage legitimate “method mapping” behavior to bypass whitelist restrictions, allowing restricted operations to be masked as permitted requests and executed. Successful exploitation may allow an attacker (with access to a restricted account) to execute unauthorized sensitive operations.  Depending on the operation invoked, impact could include device resets, unintended configuration changes, or disruption of normal operation, leading to loss of availability and integrity of the device.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C520ws V2
CVE-2026-6241

Authenticated Format String Vulnerability in ONVIF AddScopes Method on TP-Link Tapo C520WS

An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly passed to formatting functions without adequate sanitization. An attacker can inject format specifiers into ONVIF scope parameters to manipulate memory handling behavior. Successful exploitation may cause the ONVIF management service to crash, resulting in DoS condition that impacts normal device operation.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C520ws V2
CVE-2026-8714

Denial-of-Service Vulnerability in RTSP Input Handling on TP-Link's Tapo C520WS

A denial-of-service vulnerability exists in the RTSP server component of TP-Link Tapo C520WS v2 due to improper handling of syntactically invalid input.  Crafted inputs can trigger a processing error, causing the RTSP service to enter non-responsive state. Successful exploitation may cause the RTSP in a denial-of-service condition.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C520ws Tapo C520ws Firmware Tapo C520ws V2
CVE-2026-0919

Unauthenticated Denial of Service via Oversized URL in HTTP Parser on TP-Link Tapo C210, C220 & C520WS

The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively long URL path. An invalid‑URL error path continues into cleanup code that assumes allocated buffers exist, leading to a crash and service restart. An unauthenticated attacker can force repeated service crashes or device reboots, causing denial of service.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo Tapo C220 Tapo C220 Firmware and 4 more
CVE-2026-0918

Null Pointer Dereference in Tapo SmartCam HTTP Service on TP-Link Tapo C220 & C520WS

The Tapo C100 v5, C220 v1 and C520WS v2 cameras’ HTTP service does not safely handle POST requests containing an excessively large Content-Length header. The resulting failed memory allocation triggers a NULL pointer dereference, causing the main service process to crash. An unauthenticated attacker can repeatedly crash the service, causing temporary denial of service. The device restarts automatically, and repeated requests can keep it unavailable.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo Tapo C220 Tapo C220 Firmware and 4 more
CVE-2026-1315

Unauthenticated Denial of Service via Firmware Update Endpoint on TP-Link Tapo C220 & C520WS

By sending crafted files to the firmware update endpoint of Tapo C220 v1 and C520WS v2, the device terminates core system services before verifying authentication or firmware integrity. An unauthenticated attacker can trigger a persistent denial of service, requiring a manual reboot or application initiated restart to restore normal device operation.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo Tapo C220 Tapo C220 Firmware and 4 more
CVE-2026-34119

Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in TP-Link Tapo C520WS

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing loop when appending segmented request bodies without continuous write‑boundary verification, due to insufficient boundary validation when handling externally supplied HTTP input.  An attacker on the same network segment could trigger heap memory corruption conditions by sending crafted payloads that cause write operations beyond allocated buffer boundaries.  Successful exploitation causes a Denial-of-Service (DoS) condition, causing the device’s process to crash or become unresponsive.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C520ws Tapo C520ws Firmware Tapo C520ws V2
CVE-2026-34120

Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in TP-Link Tapo C520WS

A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the asynchronous parsing of local video stream content due to insufficient alignment and validation of buffer boundaries when processing streaming inputs.An attacker on the same network segment could trigger heap memory corruption conditions by sending crafted payloads that cause write operations beyond allocated buffer boundaries.  Successful exploitation causes a Denial-of-Service (DoS) condition, causing the device’s process to crash or become unresponsive.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C520ws Tapo C520ws Firmware Tapo C520ws V2
CVE-2026-34122

Stack-based Buffer Overflow Leading to Denial of Service in TP-Link Tapo C520WS

A stack-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within a configuration handling component due to insufficient input validation. An attacker can exploit this vulnerability by supplying an excessively long value for a vulnerable configuration parameter, resulting in a stack overflow. Successful exploitation results in Denial-of-Service (DoS) condition, leading to a service crash or device reboot, impacting availability.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C520ws Tapo C520ws Firmware Tapo C520ws V2
CVE-2026-34124

Denial of Service via Path Expansion Overflow in HTTP Service in TP-Link Tapo C520WS

A denial-of-service vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP request path parsing logic. The implementation enforces length restrictions on the raw request path but does not account for path expansion performed during normalization. An attacker on the adjacent network may send a crafted HTTP request to cause buffer overflow and memory corruption, leading to system interruption or device reboot.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Tapo C520ws Tapo C520ws Firmware Tapo C520ws V2