Read the docs
TI-2026-26444 Aliases CVE-2026-34122GHSA-hx8v-fm8j-mj2j

Stack-based Buffer Overflow Leading to Denial of Service in TP-Link Tapo C520WS

Priority LOW 31CWE-121Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

A stack-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within a configuration handling component due to insufficient input validation. An attacker can exploit this vulnerability by supplying an excessively long value for a vulnerable configuration parameter, resulting in a stack overflow. Successful exploitation results in Denial-of-Service (DoS) condition, leading to a service crash or device reboot, impacting availability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00271 19th percentileScored 2026-11-07
Fix Fixed Tapo C520WS v2.6 (TP-Link Systems Inc.): 1.2.4 Build 260326 Rel.24666n

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TP-LinkTapo C520WS v2.6before 1.2.4 Build 260326 Rel.24666n1.2.4 Build 260326 Rel.24666nPatch availableCNA
  • Tapo C520WS v2.6 VendorTP-Link Affected before 1.2.4 Build 260326 Rel.24666n Fixed in 1.2.4 Build 260326 Rel.24666n Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:tp-link:tapo_c520ws_firmware:*:*:*:*:*:*:*:*before 1.2.4VulnerableTP-Link
cpe:2.3:h:tp-link:tapo_c520ws:2.6:*:*:*:*:*:*:*2.6Running onTP-Link
  • cpe:2.3:o:tp-link:tapo_c520ws_firmware:*:*:*:*:*:*:*:* Versions before 1.2.4 Vulnerable ·TP-Link
  • cpe:2.3:h:tp-link:tapo_c520ws:2.6:*:*:*:*:*:*:* Versions 2.6 Running on ·TP-Link

Remediation

  • Fix · CNA Tapo C520WS v2.6 (TP-Link Systems Inc.) Fixed in 1.2.4 Build 260326 Rel.24666n

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    TP-Link Systems Tapo C520WS v2.6 — tp-link.com/us/support/faq/5047

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2026-26443 Authentication Bypass in DS Configuration Service via HTTP Request Parsing Differential of TP-Link Tapo C520WS and C210Priority MEDIUM 40
    • TI-2026-26440 Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in multiple TP-Link Tapo CamerasPriority LOW 32
    • TI-2026-26446 Denial of Service via Path Expansion Overflow in HTTP Service in TP-Link Tapo C520WSPriority LOW 31
    Show all 6 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34122
  2. 2026-10-03 Alias added: GHSA-hx8v-fm8j-mj2j

References

Patch 2

Advisory 1

  • TI-2026-26443 Authentication Bypass in DS Configuration Service via HTTP Request Parsing Differential of TP-Link Tapo C520WS and C210 CVSS 4.0HIGH 8.7
  • TI-2026-26440 Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in multiple TP-Link Tapo Cameras CVSS 4.0HIGH 7.1
  • TI-2026-01028 Unauthenticated Denial of Service via Firmware Update Endpoint on TP-Link Tapo C220 & C520WS CVSS 4.0HIGH 7.1
  • TI-2026-00695 Unauthenticated Denial of Service via Oversized URL in HTTP Parser on TP-Link Tapo C210, C220 & C520WS CVSS 4.0HIGH 7.1
  • TI-2026-00694 Null Pointer Dereference in Tapo SmartCam HTTP Service on TP-Link Tapo C220 & C520WS CVSS 4.0HIGH 7.1
  • TI-2026-26446 Denial of Service via Path Expansion Overflow in HTTP Service in TP-Link Tapo C520WS CVSS 4.0HIGH 7.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences