CVE-2026-6240
Authenticated Stack-based Buffer Overflow in ONVIF DeleteUsers Service on TP-Link Tapo C520WS
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
3th
A stack-based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF DeleteUsers service, due to insufficient boundary checks when handling multiple user deletion parameters. An authenticated attacker can send a crafted malicious request containing an excessive number of identifiers to overflow stack memory. Successful exploitation may result in a service crash or deadlock, leading to DoS affecting device management and monitoring functionality.
| CWE | CWE-121 |
| Vendor | tp-link systems inc. |
| Product | tapo c520ws v2 |
| Published | Jun 5, 2026 |
| Last Updated | Jun 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for tp-link systems inc. tapo c520ws v2
Be the first to know when new unknown vulnerabilities affecting tp-link systems inc. tapo c520ws v2 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
TP-Link Systems Inc. / Tapo C520WS v2
0 < 1.2.6 Build 260528