TP-Link Tapo C520WS v2 ONVIF Subscribe Service format string

Summaryinfo

A vulnerability, which was classified as critical, was found in TP-Link Tapo C520WS v2. The affected element is an unknown function of the component ONVIF Subscribe Service. Such manipulation leads to format string. This vulnerability is documented as CVE-2026-6242. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in TP-Link Tapo C520WS v2 (affected version not known). Affected by this issue is some unknown functionality of the component ONVIF Subscribe Service. The manipulation with an unknown input leads to a format string vulnerability. Using CWE to declare the problem leads to CWE-134. The product uses a function that accepts a format string as an argument, but the format string originates from an external source. Impacted is availability. CVE summarizes:

An authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of externally supplied parameters within formatting functions. An attacker may inject crafted format strings into event subscription requests or notification generation path to disrupt normal service execution. Successful exploitation may cause the event notification service to terminate unexpectedly, resulting in the loss of real-time alarm functionality and disruption of event notifications.

The advisory is shared for download at tp-link.com. This vulnerability is handled as CVE-2026-6242 since 04/13/2026. The exploitation is known to be easy. The attack may be launched remotely. The exploitation needs additional levels of successful authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/06/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• TP-Link

Name

• Tapo C520WS v2

License

• commercial

Website

• Vendor: https://www.tp-link.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion