Authenticated Stack-based Buffer Overflow in ONVIF CreateUsers Service in TP-Link Tao C520WS
CVE-2026-6239

6.8MEDIUM

Key Information:

Vendor

Tp-link Systems Inc.

Status
Tapo C520ws V2
Vendor
CVE Published:
5 June 2026

What is CVE-2026-6239?

A stack‑based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF CreateUsers service, where the device fails to properly validate the number of XML user nodes during request processing. An authenticated attacker can send a specially crafted ONVIF request containing an excessive number of user entries to trigger memory corruption.

Successful exploitation may cause the ONVIF management service to terminate unexpectedly, resulting in a denial‑of‑service (DoS) condition that disrupts device configuration and management functions.

Affected Version(s)

Tapo C520WS v2 0 < 1.2.6 Build 260528

References

https://www.tp-link.com/us/support/download/tapo-c520ws/#...
patch
https://www.tp-link.com/en/support/download/tapo-c520ws/#...
patch
https://www.tp-link.com/us/support/faq/5120/
vendor-advisory

CVSS V4

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.