CVE-2026-6239
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
A stack-based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF CreateUsers service, where the device fails to properly validate the number of XML user nodes during request processing. An authenticated attacker can send a specially crafted ONVIF request containing an excessive number of user entries to trigger memory corruption.
Risk Assessment
Successful exploitation may cause the ONVIF management service to terminate unexpectedly, resulting in a denial-of-service (DoS) condition that disrupts device configuration and management functions.
Recommendation
Update the Tapo C520WS camera firmware to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in Tapo C520WS
See all- CVE-2026-6242Medium
An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of externally supplied parameters within formatting functions. An attacker may inject crafted format strings into event subscription requests or notification generation path to disrupt normal service execution. Successful exploitation may cause the event notification service to terminate unexpectedly, resulting in loss of real-time alarm functionality and disruption of event notifications.
- CVE-2026-6241Medium
Format string vulnerability in the ONVIF AddScopes function in Tapo C520WS v2. User-controlled input is improperly passed to formatting functions. An attacker can inject format specifiers, causing the ONVIF service to crash and resulting in DoS.
- CVE-2026-6240Medium
The Tapo C520WS v2 device has a stack-based buffer overflow vulnerability in the ONVIF DeleteUsers service due to insufficient boundary checks when handling multiple user deletion parameters. An authenticated attacker can send a crafted request with an excessive number of identifiers to overflow stack memory.
- CVE-2026-34123High
Tapo C520WS v2 has a logic flaw in its API authorization mechanism. Restricted accounts can bypass whitelist restrictions and perform unauthorized operations like device reset or configuration changes.
Original NVD description (English source)
A stack‑based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF CreateUsers service, where the device fails to properly validate the number of XML user nodes during request processing. An authenticated attacker can send a specially crafted ONVIF request containing an excessive number of user entries to trigger memory corruption. Successful exploitation may cause the ONVIF management service to terminate unexpectedly, resulting in a denial‑of‑service (DoS) condition that disrupts device configuration and management functions.