CVE-2026-34118
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C100/C101 v5 and C520WS v2.6 in the HTTP POST body parsing logic due to missing validation of remaining buffer capacity after dynamic allocation and insufficient boundary validation. An attacker on the same network segment could trigger heap memory corruption by sending crafted payloads.
Risk Assessment
Successful exploitation can cause a denial-of-service condition, crashing the device's process or making it unresponsive, potentially disrupting surveillance operations.
Recommendation
Install firmware updates provided by TP-Link for affected models. Restrict access to devices from trusted network segments.
Other vulnerabilities in TP-Link Tapo
See all- CVE-2026-0651High
A path traversal vulnerability was identified in TP-Link Tapo C260 v1, D235 v1, C211 v2 and C520WS v2.6 within the HTTP server’s handling of GET requests. The server performs path normalization before fully decoding URL encoded input and falls back to using the raw path when normalization fails, allowing bypass of directory restrictions.
- CVE-2023-27098High
The TP-Link Tapo APK up to version 2.12.703 uses hardcoded credentials for access to the login panel. This means anyone who knows these credentials can gain unauthorized access to the application.
Original NVD description (English source)
A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C100/C101 v5, C520WS v2.6 in the HTTP POST body parsing logic due to missing validation of remaining buffer capacity after dynamic allocation, due to insufficient boundary validation when handling externally supplied HTTP input. An attacker on the same network segment could trigger heap memory corruption conditions by sending crafted payloads that cause write operations beyond allocated buffer boundaries. Successful exploitation causes a Denial-of-Service (DoS) condition, causing the device’s process to crash or become unresponsive.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS