CVE-2026-34124
7.1
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow more
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: f23511db-6c3e-4e32-a477-6aa17d310630 (Secondary)
Description
A denial-of-service vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP request path parsing logic. The implementation enforces length restrictions on the raw request path but does not account for path expansion performed during normalization. An attacker on the adjacent network may send a crafted HTTP request to cause buffer overflow and memory corruption, leading to system interruption or device reboot.
Affected (1)
Products: Tp Link: Tapo C520ws Firmware
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Before 1.2.4 |
| Running on/with | Platform Versions |
|---|---|
Tp Link Tapo C520ws | Version 2.6 |
References (3)
Source: f23511db-6c3e-4e32-a477-6aa17d310630
Release Notes
Source: f23511db-6c3e-4e32-a477-6aa17d310630
Release Notes
Source: f23511db-6c3e-4e32-a477-6aa17d310630
Vendor Advisory
Timeline
No history available yet.