VulnerabilityAnalyzed

CVE-2026-34124

A denial-of-service vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP request path parsing logic.

HIGH 7.1EPSS 0.30%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.30%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A denial-of-service vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP request path parsing logic. The implementation enforces length restrictions on the raw request path but does not account for path expansion performed during normalization. An attacker on the adjacent network may send a crafted HTTP request to cause buffer overflow and memory corruption, leading to system interruption or device reboot.

CVSS 4.0: 7.1 HIGHCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.30% probability · 22th percentile
CISA KEV: Not listed
Weakness: CWE-120
Affected: tp-link/tapo c520ws firmware
Source: f23511db-6c3e-4e32-a477-6aa17d310630

References

https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-NotesRelease Notes
https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-NotesRelease Notes
https://www.tp-link.com/us/support/faq/5047/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.